[daily secrets] Secret Usage Analysis — 2026-07-16

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-16
Workflow Files Analyzed: 258
Run: §29521850438

📊 Executive Summary

Metric	Value
Total secrets.* References	8,464
github.token References	1,677
Unique Secret Types	40
Token Cascade Instances	929
Workflows with Redaction	258 / 258
Explicit Permission Blocks	258

🛡️ Security Posture

✅ Redaction System: 258/258 workflows (100%) include redact_secrets steps
✅ Token Cascades: 929 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 258 workflows have explicit permissions: definitions
✅ Secrets in Job Outputs: 0 confirmed secret leaks into job-level outputs: blocks
i️ github.event.* Usage: 4,620 references — all appear inside env: mappings (no unsafe inline interpolation in run: steps)

🎯 Key Findings

1. GitHub token trio dominates: GITHUB_TOKEN (4,271), GH_AW_GITHUB_TOKEN (3,653), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,703) together account for ~56% of all secret references, consistent with the cascading token pattern used across all agent workflows.
2. Full redaction coverage: Every compiled workflow includes a redaction step — the highest possible coverage.
3. AI provider secrets spread broadly: ANTHROPIC_API_KEY (243) and OPENAI_API_KEY (93) are widely referenced, reflecting the multi-model AI agent architecture. CODEX_API_KEY (92) and GEMINI_API_KEY (5) also present.
4. Observability secrets concentrated: Sentry and Grafana OTEL credentials appear in 600–700 references each, indicating near-universal telemetry instrumentation.
5. Low-usage secrets warrant audit: SLACK_BOT_TOKEN (1), OPENROUTER_API_KEY (1), AZURE_* (2 each), and FOUNDRY_API_KEY (3) are used in very few workflows.

💡 Recommendations

1. Audit low-usage secrets: Secrets with ≤3 references (SLACK_BOT_TOKEN, OPENROUTER_API_KEY, FOUNDRY_*, AZURE_*) should be verified as intentionally present and not orphaned credentials.
2. Monitor COPILOT_GITHUB_TOKEN growth: At 728 references, this token is expanding and warrants a periodic access-scope audit.
3. Investigate CONTEXT secret: Only 2 references to a secret named CONTEXT — verify this is intentional and not a naming collision with environment variables.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,271	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,653	GitHub PAT
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,703	GitHub MCP Token
4	COPILOT_GITHUB_TOKEN	728	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability
8	ANTHROPIC_API_KEY	243	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
10	OPENAI_API_KEY	93	AI Provider

📋 All 40 Unique Secret Types

Secret Name	Occurrences	Category
GITHUB_TOKEN	4,271	GitHub Token
GH_AW_GITHUB_TOKEN	3,653	GitHub PAT
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,703	GitHub MCP Token
COPILOT_GITHUB_TOKEN	728	GitHub Token
GH_AW_OTEL_SENTRY_AUTHORIZATION	696	Observability
GH_AW_OTEL_SENTRY_ENDPOINT	465	Observability
GH_AW_OTEL_GRAFANA_AUTHORIZATION	463	Observability
ANTHROPIC_API_KEY	243	AI Provider
GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
OPENAI_API_KEY	93	AI Provider
CODEX_API_KEY	92	AI Provider
GH_AW_CI_TRIGGER_TOKEN	59	CI Token
GH_AW_SIDE_REPO_PAT	24	GitHub PAT
GH_AW_AGENT_TOKEN	15	Agent Token
TAVILY_API_KEY	12	AI Tool
SENTRY_OPENAI_API_KEY	10	Observability/AI
SENTRY_ACCESS_TOKEN	10	Observability
DD_APP_KEY	10	Observability
DD_APPLICATION_KEY	10	Observability
DD_API_KEY	8	Observability
DD_SITE	7	Observability
NOTION_API_TOKEN	6	Integration
GRAFANA_URL	6	Observability
GRAFANA_SERVICE_ACCOUNT_TOKEN	6	Observability
FOUNDRY_OPENAI_ENDPOINT	6	AI Provider
ANTIGRAVITY_API_KEY	6	Custom
GH_AW_PROJECT_GITHUB_TOKEN	5	GitHub PAT
GEMINI_API_KEY	5	AI Provider
BRAVE_API_KEY	4	AI Tool
AWI_MAINTENANCE_TOKEN	4	Maintenance
FOUNDRY_API_KEY	3	AI Provider
GH_AW_OTEL_DATADOG_API_KEY	2	Observability
CONTEXT	2	Unknown
AZURE_TENANT_ID	2	Cloud Auth
AZURE_CLIENT_SECRET	2	Cloud Auth
AZURE_CLIENT_ID	2	Cloud Auth
SLACK_BOT_TOKEN	1	Integration
OPENROUTER_API_KEY	1	AI Provider
GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-16 17:59 UTC
Workflow: §29521850438

Generated by 🔒 Daily Secrets Analysis Agent · 25.5 AIC · ⌖ 5.1 AIC · ⊞ 6.2K · ◷

• expires on Jul 19, 2026, 10:05 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #46290.