[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-05
Workflow Files Analyzed: 299
Run: 33981582985

📊 Executive Summary

• Total Secret References: 10,360 (secrets.*)
• GitHub Token References: 2,160 (github.token)
• Unique Secret Types: 41
• Workflows with Explicit Permission Blocks: 299/299 (100%)

🛡️ Security Posture

✅ Redaction System: 299/299 workflows (100%) have redact_secrets steps
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permissions: definitions
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASSED, no direct github.event.* interpolation found in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs — PASSED, no secrets found in job outputs

🎯 Key Findings

1. Consistent security hygiene: Every compiled workflow (299/299) has a redaction step and an explicit permissions block — no gaps found across the fleet.
2. Token cascade is the dominant pattern: GITHUB_TOKEN (5,348 refs) and GH_AW_GITHUB_TOKEN (4,543 refs) together account for ~95% of all secret references, reflecting the standard fallback-chain pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN) used for GitHub API auth.
3. Telemetry/observability secrets are widely used: OTEL-related secrets (Sentry auth/endpoint, Grafana auth) total ~1,736 references, indicating broad adoption of the OpenTelemetry integration across workflows.
4. AI engine credentials are diverse but concentrated: OPENAI_API_KEY (457), CODEX_API_KEY (456), and ANTHROPIC_API_KEY (255) round out the top 10, consistent with multi-engine support (Codex, OpenAI, Claude/Anthropic-backed engines).
5. No template-injection or output-leak issues detected by the deterministic Go test suite — both automated checks passed clean.

💡 Recommendations

1. Maintain current baseline: 100% redaction/permission coverage is the target state — any future PR that adds a workflow without these should be flagged in CI.
2. Establish historical trend tracking: This appears to be the first successful run generating stats; no prior day's dataset was found for comparison. Persisting /tmp/gh-aw/agent/secrets-stats.json (or an equivalent artifact) across runs would enable day-over-day trend detection going forward.
3. Periodically audit the long tail of secret types: With 41 unique secret types in use, consider a quarterly review to retire any secrets tied to deprecated engines or integrations.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,543	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	574	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	457	AI Engine
9	CODEX_API_KEY	456	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine

📈 Trends

No historical baseline was found for comparison — this is treated as the initial data point for the trend series. Future runs will report deltas here once prior stats become available.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-05 17:42 UTC
Workflow: .github/workflows/

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 18 AIC · ⌖ 6.98 AIC · ⊞ 9.3K · ◷

• expires on Sep 8, 2026, 9:44 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #59009.