[daily secrets] Daily Secrets Analysis - 2026-08-07

[github-actions[bot]]

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection results could not be parsed.

Review the workflow run logs for details.

🔐 Daily Secrets Analysis Report

Date: 2026-08-07
Workflow Files Analyzed: 276
Run: §31204229270

📊 Executive Summary

• Total Secret References: 9,211 (secrets.*)
• GitHub Token References: 2,077 (github.token)
• Unique Secret Types: 42
• Redaction Coverage: 276/276 workflows (100%)

🛡️ Security Posture

✅ Redaction System: 276/276 workflows have redaction steps (redact_secrets)
✅ Token Cascades: 989 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains
✅ Permission Blocks: 276 explicit permissions: definitions (one per workflow)
✅ Secrets in Job Outputs: 0 — no job-level outputs: blocks expose secrets.* values directly
✅ Template Injection: No raw github.event.* interpolation found inside run: script bodies — all event-derived data is passed through env: indirection before use, the standard safe pattern

🎯 Key Findings

1. GITHUB_TOKEN dominates usage — 4,849 references, by far the most common secret, consistent with routine gh/API auth across jobs and steps.
2. Layered token fallback is standard practice — GH_AW_GITHUB_TOKEN (4,170 refs) and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,816 refs) implement the documented cascade pattern for MCP server auth, giving workflows graceful degradation if a custom token isn't configured.
3. Observability secrets are widespread but scoped — Sentry (714 auth + 477 endpoint refs) and Grafana (475 auth + 238 endpoint refs) OTEL credentials appear across most workflows, consistent with repo-wide tracing instrumentation rather than isolated misuse.
4. AI provider keys are concentrated — ANTHROPIC_API_KEY (264), OPENAI_API_KEY (107), and CODEX_API_KEY (106) usage aligns with expected engine-specific credential needs.
5. 100% redaction coverage — every compiled workflow includes the secret-redaction step, meaning no known regression in the security baseline.

💡 Recommendations

1. No urgent action required — token cascade pattern, redaction coverage, and permission blocks are all at expected/complete levels (100% each).
2. Continue monitoring observability secret spread — if additional OTEL backends are added, confirm each new workflow's redaction step also covers the new secret names.
3. Periodically audit GH_AW_SIDE_REPO_PAT (24 refs) and GH_AW_AGENT_TOKEN (15 refs) — these are lower-frequency, higher-privilege tokens; verify their usage remains scoped to only the workflows that need cross-repo or elevated access.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,849	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,170	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,816	GitHub Token
4	COPILOT_GITHUB_TOKEN	720	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	714	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	477	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	475	Observability
8	ANTHROPIC_API_KEY	264	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	238	Observability
10	OPENAI_API_KEY	107	AI Provider

📈 Trends

No historical baseline is available yet (first recorded run for comparison). Current snapshot establishes the baseline for future daily reports:

• Total workflows: 276
• Secret refs: 9,211
• Token refs: 2,077
• Unique secret types: 42
• Redaction coverage: 100%
• Token cascade instances: 989

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-07 17:54 UTC
Workflow: daily-secrets-analysis

Generated by 🔒 Daily Secrets Analysis Agent · auto · 17 AIC · ⌖ 2.76 AIC · ⊞ 9.1K · ◷

• expires on Aug 10, 2026, 9:56 AM UTC-08:00