[daily secrets] 🔐 Daily Secrets Analysis Report — 2026-07-06

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-06
Workflow Files Analyzed: 258
Run: §28813483784

---

📊 Executive Summary

Metric	Value
Total secrets.* References	7,577
github.token References	1,575
Unique Secret Names	39
Workflows Referencing Secrets	258 / 258 (100%)
Workflows with Redaction	258 / 258 (100%)
Workflows with Permission Blocks	258 / 258 (100%)

---

🛡️ Security Posture

✅ Redaction System: Every workflow (258/258) includes a redact_secrets step — all secret values are masked from logs before they can be exposed.
✅ Explicit Permissions: Every workflow (258/258) declares a permissions: block, enforcing least-privilege access.
✅ Token Cascade Pattern: 931 instances of the 3-tier fallback (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) provide graceful degradation.
✅ No Secrets in Outputs: Zero secret values found in job outputs: definitions — no cross-job secret leakage paths detected.
✅ No Unsafe User-Content Interpolation: No direct interpolation of user-supplied fields (body/title/comment) into run: scripts detected — template injection risk is low.
✅ No secrets: inherit: No workflows use broad secrets: inherit forwarding.

---

🎯 Key Findings

1. GitHub Token Dominance: secrets.GITHUB_TOKEN (4,254) and secrets.GH_AW_GITHUB_TOKEN (3,333) account for ~100% of all 7,577 secret references combined with the MCP server token (1,408). Authentication tokens are the most pervasive secret type by a large margin.
2. Observability Surface: 5 OTEL-related secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT) appear in 711–237 occurrences each, reflecting a consistent telemetry pattern across all agentic workflows.
3. AI/ML Key Diversity: 11 distinct AI/ML API keys are in use (Anthropic, OpenAI, Codex, Gemini, Tavily, Brave, Foundry, AntiGravity, OpenRouter, Sentry-OpenAI, Context7), spanning multiple providers. ANTHROPIC_API_KEY (238) and OPENAI_API_KEY (81) lead this category.
4. Narrow-Scope Secrets: SLACK_BOT_TOKEN (1), OPENROUTER_API_KEY (1), and GH_AW_OTEL_DATADOG_ENDPOINT (1) appear in a single workflow each — indicating single-purpose integrations.
5. Artifact in Secret Scan: secrets.cjs (258 occurrences) is a false positive from redact_secrets.cjs file path references, not an actual secret. All 39 true secret names use UPPER_SNAKE_CASE convention.

---

💡 Recommendations

1. Review Narrow-Scope Secrets: SLACK_BOT_TOKEN, OPENROUTER_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, and SENTRY_ACCESS_TOKEN appear in only 1 workflow each. Verify these are still needed and consider consolidating or documenting them.
2. Audit Duplicate Datadog Keys: Both DD_API_KEY and GH_AW_OTEL_DATADOG_API_KEY exist for Datadog (8 vs 2 occurrences), as do DD_APP_KEY/DD_APPLICATION_KEY. Consider standardizing to a single naming convention.
3. Context7 Secret Tracking: CONTEXT7_API_KEY appears in the scan — verify it is intentionally in use and properly documented in the secrets inventory.
4. Continue Monitoring github.event.* Patterns: While no unsafe interpolation into run: scripts was found, 4,594 expression-level github.event.* references exist outside env: blocks (primarily in if: conditions and inline expressions). These are structurally safe by design but warrant periodic review as new workflows are added.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,254	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,333	GitHub Auth
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,408	GitHub Auth (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	711	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	475	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	473	Observability
7	COPILOT_GITHUB_TOKEN	452	GitHub Auth (Copilot)
8	ANTHROPIC_API_KEY	238	AI/ML
9	GH_AW_OTEL_GRAFANA_ENDPOINT	237	Observability
10	OPENAI_API_KEY	81	AI/ML
11	CODEX_API_KEY	80	AI/ML
12	GH_AW_CI_TRIGGER_TOKEN	60	CI/CD
13	GH_AW_SIDE_REPO_PAT	24	GitHub Auth
14	GH_AW_AGENT_TOKEN	15	Agent Auth
15	TAVILY_API_KEY	12	AI/ML (Search)

📂 Secret Inventory by Category

GitHub Auth (6): GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_SIDE_REPO_PAT, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_AGENT_TOKEN
Observability / OTEL (14): GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, SENTRY_ACCESS_TOKEN, SENTRY_OPENAI_API_KEY, DD_API_KEY, DD_APP_KEY, DD_APPLICATION_KEY, DD_SITE, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN
AI/ML APIs (11): ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, TAVILY_API_KEY, BRAVE_API_KEY, FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT, ANTIGRAVITY_API_KEY, OPENROUTER_API_KEY, CONTEXT7_API_KEY
CI/CD (1): GH_AW_CI_TRIGGER_TOKEN
Cloud / Identity (3): AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID
Integrations (4): NOTION_API_TOKEN, SLACK_BOT_TOKEN, AWI_MAINTENANCE_TOKEN, GH_AW_COPILOT_GITHUB_TOKEN

📈 Trends (Baseline Established)

This is the first run establishing the baseline for future comparisons.

Metric	Today (2026-07-06)	Yesterday	Δ
Workflow files	258	—	—
secrets.* refs	7,577	—	—
github.token refs	1,575	—	—
Unique secrets	39	—	—
Redacted workflows	258	—	—

Future runs will compare against this baseline.

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN

---

Generated: 2026-07-06T18:20:33Z
Workflow: §28813483784

Generated by 🔒 Daily Secrets Analysis Agent · 34.5 AIC · ⌖ 14.1 AIC · ⊞ 6.3K · ◷

• expires on Jul 9, 2026, 10:26 AM UTC-08:00