[daily secrets] Daily Secrets Analysis Report — 2026-08-03

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-03
Workflow Files Analyzed: 269
Run: §30840154979

📊 Executive Summary

Metric	Value
Total secrets.* references	9,103
github.token references	2,027
Unique secret names	38
Workflows with redaction steps	269 / 269 (100%)
Token cascade instances	965
Explicit permissions: blocks	269

🛡️ Security Posture

✅ Redaction System: 269/269 workflows include redact_secrets steps — full coverage.
✅ Token Cascades: 965 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback pattern, indicating consistent least-privilege token selection.
✅ Permission Blocks: Every one of the 269 lock files declares an explicit permissions: block (no implicit/default permissions).
i️ github.event.* interpolation: 4,953 matches found in lock files, but these are expected — the compiler's safe-inputs pattern writes event fields into env vars rather than interpolating them directly into shell/script bodies. No raw unguarded interpolation observed in a spot-check.
i️ Secrets near outputs:: 35 proximity matches from a naive grep, but manual spot-check shows these are step env:/script blocks near unrelated outputs: keys (e.g., MCP tool outputs), not actual secret values written into outputs:. No genuine secret leakage into job/step outputs found.

🎯 Key Findings

1. GITHUB_TOKEN dominates usage — 4,717 references, confirming most workflows rely on the default/ambient token rather than custom PATs.
2. GH_AW_GITHUB_TOKEN is the primary override — 4,069 references, the framework's standard mechanism for supplying a custom token per-workflow.
3. Observability secrets are widespread — Sentry (702 auth + 469 endpoint) and Grafana (467 auth + 234 endpoint) OTEL secrets appear in hundreds of workflows, reflecting broad telemetry instrumentation rather than a security concern.
4. AI provider keys are concentrated — ANTHROPIC_API_KEY (292), OPENAI_API_KEY (107) are the leading model-provider secrets, consistent with the primary agentic engines in use.
5. No anomalous or unexpected secret names were found; all 38 unique secret identifiers map to known categories (GitHub tokens, OTEL/observability, AI provider keys, Azure/Datadog/Slack integrations).

💡 Recommendations

1. Continue treating github.event.* matches as expected — periodically re-verify with gh aw security or actionlint template-injection checks rather than raw grep, to catch any genuinely unguarded interpolation introduced by future workflow edits.
2. Monitor growth of token cascade count relative to total workflow count; a declining ratio could indicate new workflows skipping the standard least-privilege fallback pattern.
3. No urgent action required — redaction and permission coverage remain at 100%.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,717	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,069	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,771	GitHub Token
4	COPILOT_GITHUB_TOKEN	774	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
8	ANTHROPIC_API_KEY	292	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
10	OPENAI_API_KEY	107	AI Provider

📈 Trends

No historical baseline was found for comparison (first run with persisted stats, or prior stats file unavailable in this run's workspace). Today's stats have been captured below to enable comparison in future runs:

{
  "date": "2026-08-03",
  "total_workflows": 269,
  "secret_refs": 9103,
  "token_refs": 2027,
  "unique_secrets": 38,
  "redaction_count": 269,
  "cascade_count": 965
}

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-03 18:14 UTC
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · auto · 19.1 AIC · ⌖ 3.82 AIC · ⊞ 9.1K · ◷

• expires on Aug 6, 2026, 10:17 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #50347.