[daily secrets] Daily Secrets Analysis Report - 2026-09-25

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-25
Workflow Files Analyzed: 298
Run: #36168594704

📊 Executive Summary

• Total Secret References: 10,269 (secrets.*)
• GitHub Token References: 1,919 (github.token)
• Unique Secret Types: 43
• Usage Location: 4,544 references confirmed at step-level env: blocks (job-level env-block heuristic detected none — usage remains concentrated at the step level, consistent with prior days)

🛡️ Security Posture

✅ Redaction System: 298/298 workflows have redaction steps (100%)
✅ Token Cascades: 1,012 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN)
✅ Permission Blocks: 298 explicit permission definitions (1 per workflow — full coverage)
✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts — PASSED, no direct github.event.* interpolation found in run: scripts
✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs — PASSED, no secrets exposed via job outputs

🎯 Key Findings

1. Workflow count stable: 298 lock files, unchanged from 2026-09-24. Total secret references stayed effectively flat (10,274 → 10,269, −5) with no material change in composition.
2. GITHUB_TOKEN still dominates: secrets.GITHUB_TOKEN (5,325) and secrets.GH_AW_GITHUB_TOKEN (4,544) together account for ~86% of all secret references — same dominant pattern as every prior day.
3. Full redaction coverage maintained: All 298 compiled workflows include a redact_secrets step, with no regression.
4. New secret type surfaced: unique secret types rose from 42 to 43. The addition is DD_APP_KEY, used as a fallback alongside DD_APPLICATION_KEY in mcp-inspector.lock.yml and smoke-otel-backends.lock.yml (secrets.DD_APPLICATION_KEY || secrets.DD_APP_KEY) — a defensive alias for Datadog's application-key naming rather than a new credential class.
5. github.token references unchanged: 1,919, identical to the prior day — no drift.
6. Observability and provider-key secrets remain scoped: OpenTelemetry secrets (Sentry/Grafana/Datadog) and provider API keys (OPENAI_API_KEY, CODEX_API_KEY, ANTHROPIC_API_KEY, etc.) show usage counts in line with prior days, with none appearing in outputs or run-script interpolation per the automated checks.

💡 Recommendations

1. Confirm DD_APP_KEY is intentional: Verify the DD_APPLICATION_KEY || DD_APP_KEY fallback in mcp-inspector.lock.yml and smoke-otel-backends.lock.yml reflects an intended Datadog naming compatibility shim, and consider standardizing on a single canonical secret name to avoid future confusion.
2. Continue enforcing automated checks in CI: Both TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts and TestCompiledLockFiles_NoSecretsInOutputs passed cleanly again today — keep these gating merges.
3. Periodically audit long-tail secrets: Several provider secrets have very low usage counts (e.g., GH_AW_PROJECT_GITHUB_TOKEN: 4, SQUAD_GITHUB_APP_PRIVATE_KEY: 4, SQUAD_GITHUB_TOKEN: 4); confirm these remain scoped to the minimal set of workflows that require them.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences
1	GITHUB_TOKEN	5,325
2	GH_AW_GITHUB_TOKEN	4,544
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,940
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741
5	COPILOT_GITHUB_TOKEN	524
6	GH_AW_OTEL_SENTRY_ENDPOINT	495
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493
8	OPENAI_API_KEY	398
9	CODEX_API_KEY	397
10	ANTHROPIC_API_KEY	250
11	GH_AW_OTEL_GRAFANA_ENDPOINT	247
12	GH_AW_DEFAULT_OTLP_HEADERS	102
13	GH_AW_DEFAULT_OTLP_ENDPOINT	102
14	GH_AW_CI_TRIGGER_TOKEN	70
15	GH_AW_SIDE_REPO_PAT	24

📈 Trends (vs. 2026-09-24)

• Total secret references: 10,274 → 10,269 (−5, negligible)
• github.token references: 1,919 → 1,919 (unchanged)
• Unique secret types: 42 → 43 (+1)
• New secret type: DD_APP_KEY (Datadog application-key fallback alias, 8 occurrences)
• Workflow count: 298 → 298 (unchanged)
• Token cascade usages: 1,012 → 1,012 (unchanged)

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-25 17:45 UTC
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 48.8 AIC · ⌖ 5.83 AIC · ⊞ 9.2K · ◷

• expires on Sep 28, 2026, 9:47 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #63652.