[daily secrets] 🔐 Daily Secrets Analysis Report – 2026-07-14

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-14
Workflow Files Analyzed: 256
Run: §29355723404

📊 Executive Summary

Metric	Value
Total secrets.* References	8,376
github.token References	1,569
Unique Secret Types	40
Workflows with Redaction	256 / 256 (100%)
Token Cascade Patterns	922
Explicit Permission Blocks	256 / 256 (100%)

🛡️ Security Posture

✅ Redaction System: 256/256 workflows (100%) include secret redaction steps
✅ Token Cascades: 922 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 256/256 workflows have explicit permissions: definitions
✅ No Secrets in Job Outputs: Verified — outputs: blocks do not propagate secret values
i️ github.event.* in env blocks: 4,585 references (all within env: assignments — standard pattern, not injection risk)

🎯 Key Findings

1. Full Redaction Coverage: Every compiled workflow uses redact_secrets, providing consistent secret masking across all 256 files.
2. Stable Token Cascade Pattern: 922 uses of the three-tier token fallback chain ensure graceful degradation without hard dependencies on any single token.
3. Broad API Key Footprint: 40 unique secret types are referenced, spanning multiple AI providers (Anthropic, OpenAI, Codex, Gemini, Foundry), observability stacks (Datadog, Grafana, Sentry), and platform tokens. This breadth is expected for a workflow platform of this scale.
4. github.token dominates: github.token (1,569) is used alongside secrets.GITHUB_TOKEN (4,236) and secrets.GH_AW_GITHUB_TOKEN (3,616) — reflecting the cascade pattern rather than duplication.

💡 Recommendations

1. Audit low-use secrets: Secrets with ≤2 references (e.g., AZURE_CLIENT_ID/SECRET/TENANT_ID, SLACK_BOT_TOKEN, OPENROUTER_API_KEY) may warrant review to confirm active use or cleanup.
2. Monitor secret type growth: 40 unique secret types is a meaningful surface area. Consider periodic review of newly added secrets against approved usage policy.
3. Continue cascade standardization: The token cascade pattern is healthy; ensure new workflows adopt this pattern rather than hardcoding a single token.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,236	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,616	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	MCP Server Token
4	COPILOT_GITHUB_TOKEN	703	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	59	CI Token
13	GH_AW_SIDE_REPO_PAT	24	PAT
14	GH_AW_AGENT_TOKEN	15	Agent Token
15	TAVILY_API_KEY	12	AI Provider

🔎 Low-Usage Secrets (≤ 5 references)

Secret Name	Occurrences
GH_AW_PROJECT_GITHUB_TOKEN	5
GEMINI_API_KEY	5
BRAVE_API_KEY	4
AWI_MAINTENANCE_TOKEN	4
FOUNDRY_API_KEY	3
GH_AW_OTEL_DATADOG_API_KEY	2
CONTEXT	2
AZURE_TENANT_ID	2
AZURE_CLIENT_SECRET	2
AZURE_CLIENT_ID	2
SLACK_BOT_TOKEN	1
OPENROUTER_API_KEY	1
GH_AW_OTEL_DATADOG_ENDPOINT	1

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-14 17:57 UTC
Workflow Run: §29355723404

Generated by 🔒 Daily Secrets Analysis Agent · 23 AIC · ⌖ 7.31 AIC · ⊞ 6.2K · ◷

• expires on Jul 17, 2026, 10:01 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #45796.