[daily secrets] Secret Usage Analysis – 2026-07-10

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-10
Workflow Files Analyzed: 256
Run: §29113444343

---

📊 Executive Summary

Metric	Value
Compiled workflow files	256
Lines referencing secrets.*	8,375
Lines referencing github.token	1,567
Unique secret types	40
Token cascade instances	922

---

🛡️ Security Posture

✅ Redaction System: 256/256 (100%) workflows include redact_secrets steps
✅ Permission Blocks: 256/256 (100%) workflows define explicit permissions:
✅ Token Cascades: 922 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Secrets in Job Outputs: No confirmed secret value leakage in job outputs
✅ Expression Injection: github.event.* references assigned to env: variables (correct pattern) — no unsafe inline interpolation found

---

🎯 Key Findings

1. Full redaction coverage: Every compiled workflow file contains a redaction step — secret values are masked in logs across all 256 workflows.
2. Three dominant tokens: GITHUB_TOKEN (4,236), GH_AW_GITHUB_TOKEN (3,618), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,690) account for ~73% of all secret references. The token cascade pattern provides a clean fallback hierarchy.
3. Observability secrets are well-scoped: Sentry, Grafana, and Datadog credentials appear only in observability-related workflows.
4. High github.token usage: 1,567 references indicate many steps rely on the built-in ephemeral token in addition to PATs — a positive sign.
5. AI provider keys present: ANTHROPIC_API_KEY (242), OPENAI_API_KEY (81), CODEX_API_KEY (80), GEMINI_API_KEY (5), OPENROUTER_API_KEY (1) — broad AI provider coverage across agentic workflows.

---

💡 Recommendations

1. Audit COPILOT_GITHUB_TOKEN usage (701 occurrences): Verify these are only in workflows requiring Copilot-specific scopes, not as a general PAT substitute.
2. Review GH_AW_SIDE_REPO_PAT (24) and GH_AW_AGENT_TOKEN (15): Lower-usage tokens with broad names — confirm least-privilege scopes and document purpose.
3. Consolidate AI provider keys: Five AI providers are present (ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY). Periodically rotate and audit which workflows consume each.
4. Monitor AWI_MAINTENANCE_TOKEN (4) and SLACK_BOT_TOKEN (1): Low-frequency tokens may indicate legacy integrations; confirm still needed.

---

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,236	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,618	GitHub PAT
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	GitHub PAT (MCP)
4	COPILOT_GITHUB_TOKEN	701	GitHub PAT (Copilot)
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	60	CI Token
13	GH_AW_SIDE_REPO_PAT	24	GitHub PAT
14	GH_AW_AGENT_TOKEN	15	Agent Token
15	TAVILY_API_KEY	12	AI Tool
16	SENTRY_OPENAI_API_KEY	10	AI Provider
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability
19	DD_APPLICATION_KEY	10	Observability
20	DD_API_KEY	8	Observability

📋 All 40 Secret Types

ANTHROPIC_API_KEY, ANTIGRAVITY_API_KEY, AWI_MAINTENANCE_TOKEN, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, BRAVE_API_KEY, CODEX_API_KEY, CONTEXT, COPILOT_GITHUB_TOKEN, DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY, DD_SITE, FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT, GEMINI_API_KEY, GH_AW_AGENT_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_SIDE_REPO_PAT, GITHUB_TOKEN, GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_URL, NOTION_API_TOKEN, OPENAI_API_KEY, OPENROUTER_API_KEY, SENTRY_ACCESS_TOKEN, SENTRY_OPENAI_API_KEY, SLACK_BOT_TOKEN, TAVILY_API_KEY

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-10T18:09:35Z
Workflow Run: §29113444343

Generated by 🔒 Daily Secrets Analysis Agent · 29.7 AIC · ⌖ 5.14 AIC · ⊞ 6.2K · ◷

• expires on Jul 13, 2026, 10:14 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #44999.