[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-04
Workflow Files Analyzed: 273
Run: §30937283872

📊 Executive Summary

• Total Secret References: 9,232 (secrets.*)
• GitHub Token References: 2,051 (github.token)
• Unique Secret Types: 40 (41 raw entries, 1 blank/malformed capture group excluded)
• Secrets Coverage: All 273 lock files contain secrets.* references (~34 refs/workflow avg)

🛡️ Security Posture

✅ Redaction System: 273/273 (100%) workflows have redact_secrets steps
✅ Token Cascades: 979 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain
✅ Permission Blocks: 273/273 workflows have explicit permissions: blocks

Template interpolation scan: 5,052 raw hits for github.event. patterns across lock files. These are largely expected — gh-aw's compiler sanitizes untrusted github.event.* fields by assigning them to intermediate env: variables before use in scripts, rather than interpolating them directly into shell/JS. A raw text grep can't distinguish safe env:-mediated usage from risky direct interpolation, so this number is not by itself an indicator of vulnerability — no actionlint or compiler warnings were raised. Recommend using the compiler's own template-injection linter (not text grep) for a precise signal in future runs.

Secrets in outputs: No genuine outputs: blocks (job/step level) contained direct secrets.* references — the earlier raw grep matched unrelated container-mount lines that happened to appear near the word "outputs" (grep context window artifact), not actual output-block secret exposure. ✅

🎯 Key Findings

1. GITHUB_TOKEN dominates usage — 4,794 references (52% of all secret refs), followed by GH_AW_GITHUB_TOKEN (4,129) and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,797), consistent with the standard token-cascade pattern used for GitHub API auth.
2. LLM provider keys are present but scoped: ANTHROPIC_API_KEY (292), OPENAI_API_KEY (107), COPILOT_GITHUB_TOKEN (788), CODEX_API_KEY (106) — usage volumes look proportional to the number of workflows configured for each engine.
3. Observability secrets are notable: OTEL/Sentry and Grafana auth+endpoint secrets total ~1,880 references combined, reflecting broad telemetry instrumentation across workflows rather than a security concern.
4. 100% redaction and permission coverage — every compiled workflow includes both a redaction step and an explicit permissions block, indicating consistent application of the compiler's security defaults.

💡 Recommendations

1. Run the compiler's dedicated template-injection lint (rather than a raw github.event. grep) in future daily scans to get a precise, low-noise signal instead of the current high-noise raw count.
2. Continue monitoring the GH_AW_SIDE_REPO_PAT (24 refs) and GH_AW_AGENT_TOKEN (16 refs) — lower-volume, higher-privilege secrets — for unexpected growth in usage count, which could indicate scope creep.
3. No urgent action required this cycle; posture is stable and consistent with prior compiler security defaults (100% redaction/permissions coverage).

🔑 Top secrets by usage

Rank	Secret Name	Occurrences
1	GITHUB_TOKEN	4,794
2	GH_AW_GITHUB_TOKEN	4,129
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,797
4	COPILOT_GITHUB_TOKEN	788
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	705
6	GH_AW_OTEL_SENTRY_ENDPOINT	471
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	469
8	ANTHROPIC_API_KEY	292
9	GH_AW_OTEL_GRAFANA_ENDPOINT	235
10	OPENAI_API_KEY	107
11	CODEX_API_KEY	106
12	GH_AW_CI_TRIGGER_TOKEN	61
13	GH_AW_SIDE_REPO_PAT	24
14	GH_AW_AGENT_TOKEN	16

📈 Trends

This is treated as a baseline run for stat comparison (no prior daily-secrets stats file was found in the workspace to diff against). Stats have been noted here for manual comparison in future runs:

• Total workflows: 273
• Secret refs: 9,232
• Token refs: 2,051
• Unique secret types: 40
• Redaction coverage: 273/273 (100%)
• Cascade usages: 979

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-04

Generated by 🔒 Daily Secrets Analysis Agent · auto · 16.6 AIC · ⌖ 2.6 AIC · ⊞ 9.1K · ◷

• expires on Aug 7, 2026, 10:16 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #50663.