[daily secrets] Daily Secrets Analysis Report - 2026-09-13

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-13
Workflow Files Analyzed: 299
Run: https://github.com/github/gh-aw/actions/runs/34772208941

📊 Executive Summary

• Total Secret References: 10,307 (secrets.*)
• GitHub Token References: 1,916 (github.token)
• Unique Secret Types: 42
• Job-Level Usage (approx.): 2,190 (12.1%)
• Step-Level Usage (approx.): 15,907 (87.9%)

Note: job/step-level split is derived from a line-position heuristic (secret refs appearing before vs. within a file's steps: block) and includes env:/with: matches, so absolute counts differ from a strict per-step grep; the qualitative conclusion (secrets are overwhelmingly scoped at step level) is consistent with prior reports.

🛡️ Security Posture

✅ Redaction System: 299/299 workflows have redaction steps (100%)
✅ Token Cascades: 1,014 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 299 explicit permission definitions (1 per workflow)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASS, no direct github.event.* interpolation found in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs — PASS, no secret values exposed via job/workflow_call outputs

🎯 Key Findings

1. 100% redaction coverage: Every one of the 299 compiled lock files includes a redact_secrets step, confirming the secret-masking safeguard is applied repo-wide with no gaps.
2. Token usage dominates: GITHUB_TOKEN (5,348), GH_AW_GITHUB_TOKEN (4,557), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,945) together account for the vast majority of secret references — expected given the token-cascade pattern used for MCP server authentication.
3. Observability secrets are the next largest category: OpenTelemetry/Sentry/Grafana related secrets (GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT) total ~1,984 references, reflecting broad tracing instrumentation.
4. AI engine credentials remain bounded: OPENAI_API_KEY (398), CODEX_API_KEY (397), and ANTHROPIC_API_KEY (255) appear consistently with the number of workflows using those engines.
5. Workflow count grew vs. prior baseline: total workflow files analyzed is 299, matching the last several days (was 299 on 2026-09-12), indicating a stable count with no net additions/removals since the last report.
6. No anomalies detected: Both automated Go-based security checks (template injection in run scripts, secret leakage via outputs) passed cleanly with zero findings, identical to the prior day's run.

💡 Recommendations

1. Maintain step-level scoping discipline: Continue avoiding job-level env: secret assignments in new/updated workflows; review the "job-level" 12.1% heuristic bucket periodically to confirm it isn't hiding genuine job-level secret exposure.
2. Keep the token-cascade pattern as default: The GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain (1,014 uses) is a good least-privilege pattern; ensure new MCP-based workflows adopt it rather than hardcoding secrets.GITHUB_TOKEN directly.
3. Keep running the two Go security tests in CI (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts, TestCompiledLockFiles_NoSecretsInOutputs) as part of the compile/release pipeline, not just in this daily audit, to catch regressions before merge.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5,348	GitHub Token
2	GH_AW_GITHUB_TOKEN	4,557	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,945	GitHub Token
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744	Observability
5	COPILOT_GITHUB_TOKEN	527	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	497	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine

📈 Trends (vs. 2026-09-12 report, #60444)

Metric	2026-09-12	2026-09-13	Change
Total workflows	299	299	0
Total secret refs	10,307	10,307	0
GitHub token refs	1,916	1,916	0
Unique secret types	42	42	0
Redaction coverage	100%	100%	—
Token cascade usages	1,014	1,014	0
Permission blocks	299	299	0

No new or removed secret types detected; totals are unchanged since the previous run, indicating no new workflows or secret-usage changes were compiled between the two reports.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-13 17:43 UTC
Workflow: Daily Secrets Analysis Agent

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 40.1 AIC · ⌖ 7.12 AIC · ⊞ 9.5K · ◷

• expires on Sep 16, 2026, 9:45 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #60894.