[daily secrets] Secret Usage Analysis — 2026-07-11

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-11
Workflow Files Analyzed: 256
Run: §29162449342

📊 Executive Summary

Metric	Value
Total secrets.* References	8,377
github.token References	1,567
Unique Secret Types	40
Job-Level env Blocks	1,559
Step-Level env Blocks	13,734

🛡️ Security Posture

✅ Redaction System: 256/256 workflows have redact_secrets steps (100% coverage)
✅ Token Cascades: 922 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 256 explicit permissions: definitions (100% coverage)

⚠️ Security Findings

Template Injection Risk — Needs Review
Found 4,575 occurrences of github.event.* references outside of env: blocks. These could represent expression injection risks if user-controlled event data flows into shell commands via inline expressions. Each instance should be verified to ensure data is passed via environment variables, not inline expressions.

Secrets in Job Outputs
Found 33 potential cases where secrets appear in job outputs sections. On closer inspection these appear to be secrets.GITHUB_TOKEN passed as github-token: action inputs (standard pattern). No critical exposure found.

🎯 Key Findings

1. Universal Security Controls: All 256 workflows have both redaction steps and explicit permissions — excellent baseline posture.
2. Token Cascade Pattern: 922 uses of the three-tier token fallback chain ensures workflows degrade gracefully across permission levels.
3. AI Provider Diversity: 40 unique secret types reflect the breadth of AI/ML integrations (Anthropic, OpenAI, Gemini, Codex, Foundry, OpenRouter, etc.).
4. GITHUB_TOKEN Dominance: secrets.GITHUB_TOKEN (4,238) + secrets.GH_AW_GITHUB_TOKEN (3,618) together account for ~94% of all secret references — most secrets are authentication tokens, not sensitive data keys.
5. Observability Integration: Sentry, Grafana, and Datadog secrets appear consistently, indicating strong telemetry coverage.

💡 Recommendations

1. Audit Template Injection Risks: Review the 4,575 github.event.* usages outside env: blocks. Ensure all user-controlled data is passed via environment variables (not inline ${{ }} expressions in shell). Run actionlint to surface unsafe expression uses.
2. Validate Secrets in Outputs: Confirm the 33 flagged cases are all safe github-token: input patterns, not raw secret values exported as job outputs.
3. Secret Rotation Schedule: With 40+ unique secret types across AI providers, consider documenting rotation cadence for each category.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,238	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,618	GitHub Auth
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	GitHub Auth
4	COPILOT_GITHUB_TOKEN	701	GitHub Auth
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	60	CI Auth
13	GH_AW_SIDE_REPO_PAT	24	GitHub Auth
14	GH_AW_AGENT_TOKEN	15	GitHub Auth
15	TAVILY_API_KEY	12	AI Provider

🗂️ All Secret Types by Category

GitHub Auth: GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GH_AW_SIDE_REPO_PAT, GH_AW_AGENT_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN, AWI_MAINTENANCE_TOKEN

AI Providers: ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT, OPENROUTER_API_KEY, BRAVE_API_KEY, ANTIGRAVITY_API_KEY, SENTRY_OPENAI_API_KEY

Observability: GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY, DD_SITE, GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_URL, SENTRY_ACCESS_TOKEN

Other: NOTION_API_TOKEN, SLACK_BOT_TOKEN, TAVILY_API_KEY, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID, CONTEXT

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: Sat Jul 11 17:56:12 UTC 2026
Workflow Run: §29162449342

Generated by 🔒 Daily Secrets Analysis Agent · 30.3 AIC · ⌖ 7.51 AIC · ⊞ 6.2K · ◷

• expires on Jul 14, 2026, 10:00 AM UTC-08:00