[daily secrets] Daily Secrets Analysis - 2026-08-16

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-16
Workflow Files Analyzed: 285
Run: https://github.com/github/gh-aw/actions/runs/31962251954

📊 Executive Summary

• Total Secret References: 9,773 (secrets.*)
• GitHub Token References: 2,129 (github.token)
• Unique Secret Types: 40
• Job-Level Usage: 0 (0%)
• Step-Level Usage: 4,487 (100%)

🛡️ Security Posture

✅ Redaction System: 285/285 workflows have redaction steps
✅ Token Cascades: 1,020 instances of fallback chains
✅ Permission Blocks: 285 explicit permission definitions

• Template injection check: Found 3,259 ${{ github.event.* }} expressions across 285 files. Sampled several occurrences (e.g. ab-testing-advisor.lock.yml) and confirmed all values are assigned to intermediate env: variables (e.g. GH_AW_EXPR_*, GH_AW_WORKFLOW_DISPATCH_AW_CONTEXT) rather than interpolated directly into run: shell command bodies. This matches the compiler's standard safe pattern for untrusted expression handling — no direct injection risk detected in the sampled set.
• Secrets in outputs check: Initial broad grep flagged 38 lines, but a precise structural check (searching within actual outputs: blocks only) found zero real matches — the earlier hits were unrelated secrets.* lines incidentally near unrelated outputs: keys elsewhere in dense files. ✅ No secrets exposed via job outputs.

🎯 Key Findings

1. Redaction coverage is complete: All 285 compiled workflows include a redact_secrets step, consistent with prior runs — no regression in secret-scrubbing coverage.
2. Token usage dominated by cascading fallback pattern: GITHUB_TOKEN (4,998), GH_AW_GITHUB_TOKEN (4,305), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,874) account for the bulk of references, reflecting the standard MCP server token fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) used 1,020 times.
3. Secret usage is exclusively step-level: 100% of matched secret references occur within step env: blocks rather than job-level env: blocks, which is the expected/preferred pattern for minimizing secret exposure scope.
4. Observability secrets (OTEL) are widespread: Grafana and Sentry OTEL authorization/endpoint secrets appear ~1,976 times combined, indicating broad telemetry instrumentation across workflows.
5. No anomalies in outputs or direct shell interpolation were confirmed after manual verification of automated flags — both initial "concerns" were false positives from naive grep windowing.

💡 Recommendations

1. Keep the false-positive-prone grep heuristics in mind for future automated runs — outputs and template-injection checks based on fixed line-window greps require manual/structural verification (as done here) to avoid noisy alerts.
2. Continue monitoring token cascade adoption — some workflows may still use bare GITHUB_TOKEN without falling back through the MCP server token chain; a dedicated audit of the ~4,998 raw GITHUB_TOKEN refs vs the 1,020 full cascades could reveal workflows to migrate to the standard cascade.
3. No urgent security action required this cycle — posture is stable and consistent with expected patterns.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4998	GitHub Token
2	GH_AW_GITHUB_TOKEN	4305	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1874	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741	Observability
5	COPILOT_GITHUB_TOKEN	735	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	495	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493	Observability
8	ANTHROPIC_API_KEY	269	LLM Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	247	Observability
10	DOCKER_USERNAME / DOCKER_PAT	135 each	Registry

📈 Trends

No historical stats file was found from a previous run, so this is treated as the baseline day. Current snapshot saved for tomorrow's comparison:

{
  "date": "2026-08-16",
  "total_workflows": 285,
  "secret_refs": 9773,
  "token_refs": 2129,
  "unique_secrets": 40,
  "redaction_count": 285,
  "cascade_count": 1020
}

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-16T17:42:42Z
Workflow: .github/workflows/daily-secrets-analysis.md (this workflow's definition)

Generated by 🔒 Daily Secrets Analysis Agent · auto · 18.9 AIC · ⌖ 2.29 AIC · ⊞ 9.2K · ◷

• expires on Aug 19, 2026, 9:45 AM UTC-08:00