[daily secrets] 🔐 Daily Secrets Analysis Report — 2026-07-15

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-15
Workflow Files Analyzed: 256
Run: §29438626813

📊 Executive Summary

Metric	Value
Total secrets.* references	8,373
github.token references	1,603
Unique secret types	40
Step-level secret usage	3,962
Workflows analyzed	256

🛡️ Security Posture

✅ Redaction System: 256/256 (100%) workflows have redaction steps
✅ Token Cascades: 922 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 256/256 (100%) workflows have explicit permission definitions

🔍 Security Checks

Template injection patterns: 4,581 occurrences of github.event.* references detected. On inspection, these are properly sandboxed — all event data is assigned to environment variables via ${{ github.event.* }} expressions (not inlined into run scripts), which is the correct safe pattern. No raw injection into run: steps detected.

Secrets in job outputs: Initial grep suggested 33 findings, but deeper inspection confirmed these are false positives — no secrets are being passed through outputs: blocks. The matches were from env-block context windows.

🎯 Key Findings

1. Complete security coverage: All 256 workflows have both redaction steps and explicit permission blocks — excellent baseline hygiene.
2. Token cascade pattern is well-adopted: 922 uses of the 3-tier fallback chain provide consistent token availability with least-privilege ordering.
3. High GITHUB_TOKEN/GH_AW_GITHUB_TOKEN concentration: These two secrets account for 7,852 of 8,373 references (93.8%), indicating good centralization rather than scattered custom tokens.
4. 41 unique secret identifiers (including cjs which appears to be a grep artifact from file extension matching — not a real secret).
5. AI provider keys present: ANTHROPIC (241), OPENAI (81), CODEX (80), GEMINI (5), OPENROUTER (1), FOUNDRY (3) — these should be rotated on a regular cadence given broad workflow usage.

💡 Recommendations

1. AI API Key Rotation: With 241 references to ANTHROPIC_API_KEY and 81 to OPENAI_API_KEY, ensure these are rotated quarterly and scoped to minimum permissions.
2. COPILOT_GITHUB_TOKEN audit: 709 references across workflows — verify this token has only required scopes.
3. Observability secrets scope check: DD (Datadog), Grafana, and Sentry tokens (20+ references each) should be validated as read-only/write-only as appropriate.
4. Grep artifact cleanup: The cjs entry (256 matches) in secret extraction is a tooling artifact matching secrets.*.cjs filenames — not a real secret. No action needed.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,235	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,617	GitHub Token (custom)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	GitHub MCP Token
4	COPILOT_GITHUB_TOKEN	709	Copilot Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	693	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	463	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	461	Observability
8	ANTHROPIC_API_KEY	241	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	231	Observability
10	OPENAI_API_KEY	81	AI Provider

📋 All Secret Types by Category

GitHub Tokens (9,251 refs): GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_AGENT_TOKEN, GH_AW_CI_TRIGGER_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN, GH_AW_SIDE_REPO_PAT, AWI_MAINTENANCE_TOKEN

Observability (1,388 refs): GH_AW_OTEL_SENTRY_*, GH_AW_OTEL_GRAFANA_*, GH_AW_OTEL_DATADOG_*, DD_*, GRAFANA_*, SENTRY_*

AI Providers (339 refs): ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY, FOUNDRY_*, BRAVE_API_KEY, TAVILY_API_KEY

Cloud/Infrastructure (6 refs): AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID

Other (13 refs): NOTION_API_TOKEN, SLACK_BOT_TOKEN, ANTIGRAVITY_API_KEY, CONTEXT

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-15 18:00 UTC
Workflow: §29438626813

Generated by 🔒 Daily Secrets Analysis Agent · 20.2 AIC · ⌖ 7.46 AIC · ⊞ 6.2K · ◷

• expires on Jul 18, 2026, 10:04 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #46061.