[daily secrets] 🔐 Secrets Analysis Report – 2026-07-26

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-26
Workflow Files Analyzed: 262
Run: §30213552496

📊 Executive Summary

Metric	Value
Total secrets.* References	8,616
github.token References	1,853
Unique Secret Types	41
Workflows Analyzed	262
Workflows With No Secret Refs	0

🛡️ Security Posture

Control	Status	Count
Redaction Steps	✅ All workflows	262/262
Token Cascade Chains	✅ Healthy	939 instances
Explicit permissions: Blocks	✅ All workflows	262/262
Secrets Exposed in Job Outputs	✅ None found	0
Template Injection Risks	✅ None — flagged lines are valid if: conditions and Handlebars templates	0

All 262 workflows have redaction steps and explicit permission blocks — the security baseline is solid.

🎯 Key Findings

1. Token Cascade Pattern is Pervasive — 939 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN provide multi-level token fallback, ensuring workflows function even when optional tokens are absent.
2. GITHUB_TOKEN Dominates — With 4,326 references, the built-in GITHUB_TOKEN is the most-used secret, which is healthy as it requires no external management.
3. OTEL Observability Secrets are Widespread — Sentry (702+469 = 1,171 refs) and Grafana (467+234 = 701 refs) observability secrets appear across most workflows, reflecting deep telemetry integration.
4. 41 Unique Secret Types — Spans GitHub tokens, AI API keys (Anthropic, OpenAI, Codex, Gemini, etc.), observability backends (Datadog, Grafana, Sentry), and utility tokens (Slack, Notion, Brave).
5. cjs Artifact — A grep artifact (cjs) appeared in the unique-secret extraction due to redact_secrets.cjs references; it is not a real secret type.

💡 Recommendations

1. Audit Low-Usage Secrets — OPENROUTER_API_KEY (1 ref), SLACK_BOT_TOKEN (1 ref), GH_AW_OTEL_DATADOG_ENDPOINT (1 ref), and AI_GATEWAY_API_KEY (2 refs) have very low usage. Verify they are still needed or remove to reduce the secret surface area.
2. Monitor Azure Credentials — AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID each appear only twice. Confirm these are intentionally scoped to specific workflows.
3. Continue Full Redaction Coverage — 262/262 workflows have redaction — maintain this as new workflows are added.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,326	GitHub Built-in
2	GH_AW_GITHUB_TOKEN	3,700	GitHub PAT
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,724	GitHub PAT (MCP)
4	COPILOT_GITHUB_TOKEN	750	GitHub PAT (Copilot)
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
8	ANTHROPIC_API_KEY	272	AI API
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
10	OPENAI_API_KEY	103	AI API
11	CODEX_API_KEY	102	AI API
12	GH_AW_CI_TRIGGER_TOKEN	59	CI Automation
13	GH_AW_SIDE_REPO_PAT	24	GitHub PAT
14	GH_AW_AGENT_TOKEN	15	Agent Auth
15	TAVILY_API_KEY	12	Search API

🔬 Low-Usage Secrets (Potential Candidates for Removal)

Secret Name	Occurrences	Notes
SLACK_BOT_TOKEN	1	Single workflow
OPENROUTER_API_KEY	1	Single workflow
GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability
AI_GATEWAY_API_KEY	2	Low adoption
CONTEXT	2	Investigate purpose
AZURE_CLIENT_ID/SECRET/TENANT_ID	2 each	Azure integration
FOUNDRY_API_KEY	3	Low adoption
AWI_MAINTENANCE_TOKEN	4	Maintenance

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-26T17:57 UTC
Workflow: §30213552496

Generated by 🔒 Daily Secrets Analysis Agent · sonnet46 · 21.5 AIC · ⌖ 8 AIC · ⊞ 6.3K · ◷

• expires on Jul 29, 2026, 9:59 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #48418.