[daily secrets] Secret Usage Analysis — 2026-07-20

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-20
Workflow Files Analyzed: 260
Run: §29767072109

📊 Executive Summary

Metric	Count
Total secrets.* references	8,574
github.token references	1,839
Unique secret types	41
Workflow files analyzed	260

GitHub token secrets (GITHUB_TOKEN + GH_AW_GITHUB_TOKEN + GH_AW_GITHUB_MCP_SERVER_TOKEN) account for 9,688 references — approximately 56% of all secret usage — reflecting the agentic, GitHub-API-heavy nature of these workflows.

🛡️ Security Posture

✅ Redaction System: 260/260 workflows (100%) have redaction steps
✅ Token Cascades: 933 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 260 explicit permissions: definitions (one per workflow)
✅ No secrets in job outputs: All secrets.* hits near outputs: sections are in env: blocks, not actual job-level output declarations
✅ No template injection risks: All github.event.* references are in safe env: assignments or if: condition expressions

🎯 Key Findings

1. Full coverage of security controls: Every compiled workflow has both a permissions: block and a redaction step — the security baseline is uniformly enforced across all 260 files.
2. Token cascade pattern is well-adopted: 933 usages of the 3-level token fallback chain ensure graceful degradation across environments.
3. AI API key diversity: 12 distinct AI/LLM keys in use (ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, FOUNDRY_API_KEY, AI_GATEWAY_API_KEY, OPENROUTER_API_KEY, SENTRY_OPENAI_API_KEY, BRAVE_API_KEY, TAVILY_API_KEY, ANTIGRAVITY_API_KEY, COPILOT_GITHUB_TOKEN), reflecting multi-model strategy.
4. Observability secrets are consistent: Sentry, Grafana, and Datadog secrets appear in balanced endpoint+authorization pairs.

💡 Recommendations

1. Audit low-use secrets: 8 secrets appear in ≤2 workflows (AI_GATEWAY_API_KEY, CONTEXT, AZURE_CLIENT_ID/SECRET/TENANT_ID, SLACK_BOT_TOKEN, OPENROUTER_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT). Confirm these are still needed or consolidate.
2. Monitor AI key sprawl: With 12+ AI API keys, consider routing via a single gateway (AI_GATEWAY_API_KEY) to reduce secret surface area.
3. Rotation blast radius awareness: GITHUB_TOKEN-family secrets have 9,688+ references — ensure rotation procedures are documented and tested.

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,298	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,677	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,713	GitHub Token
4	COPILOT_GITHUB_TOKEN	748	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
8	ANTHROPIC_API_KEY	272	AI / LLM
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
10	OPENAI_API_KEY	103	AI / LLM
11	CODEX_API_KEY	102	AI / LLM
12	GH_AW_CI_TRIGGER_TOKEN	59	CI / Automation
13	GH_AW_SIDE_REPO_PAT	24	CI / Automation
14	GH_AW_AGENT_TOKEN	15	CI / Automation
15	TAVILY_API_KEY	12	AI / LLM
16	SENTRY_OPENAI_API_KEY	10	AI / LLM
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability
19	DD_APPLICATION_KEY	10	Observability
20	DD_API_KEY	8	Observability

📋 All 41 Unique Secret Types

Secret Name	Occurrences	Category
AI_GATEWAY_API_KEY	2	AI / LLM
ANTHROPIC_API_KEY	272	AI / LLM
ANTIGRAVITY_API_KEY	6	AI / LLM
AWI_MAINTENANCE_TOKEN	4	CI / Automation
AZURE_CLIENT_ID	2	Cloud / Auth
AZURE_CLIENT_SECRET	2	Cloud / Auth
AZURE_TENANT_ID	2	Cloud / Auth
BRAVE_API_KEY	4	AI / LLM
CODEX_API_KEY	102	AI / LLM
CONTEXT	2	Misc
COPILOT_GITHUB_TOKEN	748	GitHub Token
DD_API_KEY	8	Observability
DD_APPLICATION_KEY	10	Observability
DD_APP_KEY	10	Observability
DD_SITE	7	Observability
FOUNDRY_API_KEY	3	AI / LLM
FOUNDRY_OPENAI_ENDPOINT	6	AI / LLM
GEMINI_API_KEY	5	AI / LLM
GH_AW_AGENT_TOKEN	15	CI / Automation
GH_AW_CI_TRIGGER_TOKEN	59	CI / Automation
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,713	GitHub Token
GH_AW_GITHUB_TOKEN	3,677	GitHub Token
GH_AW_OTEL_DATADOG_API_KEY	2	Observability
GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability
GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
GH_AW_PROJECT_GITHUB_TOKEN	4	GitHub Token
GH_AW_SIDE_REPO_PAT	24	CI / Automation
GITHUB_TOKEN	4,298	GitHub Token
GRAFANA_SERVICE_ACCOUNT_TOKEN	6	Observability
GRAFANA_URL	6	Observability
NOTION_API_TOKEN	6	Misc
OPENAI_API_KEY	103	AI / LLM
OPENROUTER_API_KEY	1	AI / LLM
SENTRY_ACCESS_TOKEN	10	Observability
SENTRY_OPENAI_API_KEY	10	AI / LLM
SLACK_BOT_TOKEN	1	Misc
TAVILY_API_KEY	12	AI / LLM

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-20T18:19:37Z
Workflow Run: §29767072109

Generated by 🔒 Daily Secrets Analysis Agent · 38.9 AIC · ⌖ 8.21 AIC · ⊞ 6.2K · ◷

• expires on Jul 23, 2026, 10:22 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #47123.