[daily secrets] Daily Secrets Analysis Report - 2026-09-27

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-09-27
Workflow Files Analyzed: 298
Run: https://github.com/github/gh-aw/actions/runs/36337730177

📊 Executive Summary

• Total Secret References: 10,274 (secrets.*)
• GitHub Token References: 1,919 (github.token)
• Unique Secret Types: 43
• Step-Level Usage: 4,544 references to GH_AW_GITHUB_TOKEN alone confirm secrets are consumed almost exclusively at the step level (inside run:/with: blocks) rather than job-level env: blocks, consistent with the compiler's per-step secret injection pattern.

🛡️ Security Posture

• ✅ Redaction System: 298/298 workflows have redaction steps (100% coverage)
• ✅ Token Cascades: 1,011 instances of the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chain
• ✅ Permission Blocks: 298 explicit permissions: definitions (1 per workflow, 100% coverage)
• ✅ Template Injection Check: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed — no direct github.event.* interpolation found in run: scripts
• ✅ Secrets-in-Outputs Check: TestCompiledLockFiles_NoSecretsInOutputs passed — no secrets found in job outputs

🎯 Key Findings

1. Universal redaction and permission coverage maintained: All 298 compiled workflows (up from 298 yesterday — fleet size unchanged) still include both a secret-redaction step and an explicit permissions: block, with zero regressions.
2. Secret reference volume is essentially flat: 10,274 total secrets.* references today vs. 10,269 yesterday (+5, +0.05%) — a negligible day-over-day change consistent with routine, low-risk workflow edits rather than a new integration.
3. Unique secret type count grew by one (42 → 43). The full type roster spans GitHub tokens, AI-engine keys (OpenAI, Codex, Anthropic, Gemini, Cursor, Kiro, Foundry), observability credentials (Sentry, Grafana, Datadog, OTLP), and integration tokens (Linear, Jira, Slack, Squad GitHub App). No single new addition stood out as disproportionately used — all newly-observed names in this scan have low occurrence counts (≤8), suggesting incremental, scoped additions rather than a broad new dependency.
4. GitHub token usage still dominates: GITHUB_TOKEN (5,324) and GH_AW_GITHUB_TOKEN (4,543) together account for ~96% of all secret references, reflecting the consistent fallback-cascade pattern used across MCP server and CLI tooling integration points (1,011 cascade instances, unchanged from yesterday).
5. No anomalies detected: Both automated Go tests (template-injection and secrets-in-outputs) passed cleanly with zero flagged workflows — the same clean result as the prior report.

💡 Recommendations

1. Keep the 100% redaction/permissions coverage as a hard CI gate. The metric has now held steady across at least two consecutive days; formalizing it (fail compilation if a new .lock.yml lacks either control) would lock in the current baseline.
2. Spot-check newly introduced low-frequency secrets (e.g., DD_* Datadog keys, JIRA_*, GRAFANA_SERVICE_ACCOUNT_TOKEN, SQUAD_GITHUB_APP_PRIVATE_KEY) for correct scoping and redaction pattern coverage, since low occurrence counts make them easy to overlook in broader security passes.
3. Continue day-over-day trend tracking — with two consecutive data points now available, consider persisting secrets-stats.json as a workflow artifact so future runs can compute deltas without re-scraping prior discussion bodies.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	5324	GitHub Token
2	GH_AW_GITHUB_TOKEN	4543	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1939	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	741	Observability
5	COPILOT_GITHUB_TOKEN	520	GitHub Token
6	GH_AW_OTEL_SENTRY_ENDPOINT	495	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	493	Observability
8	OPENAI_API_KEY	398	AI Engine
9	CODEX_API_KEY	397	AI Engine
10	ANTHROPIC_API_KEY	255	AI Engine
11	GH_AW_OTEL_GRAFANA_ENDPOINT	247	Observability
12	GH_AW_DEFAULT_OTLP_HEADERS	102	Observability
13	GH_AW_DEFAULT_OTLP_ENDPOINT	102	Observability
14	GH_AW_CI_TRIGGER_TOKEN	70	CI/Automation
15	GH_AW_SIDE_REPO_PAT	24	Repository Access

📈 Trends (vs. 2026-09-26 report, #63652)

Metric	2026-09-26	2026-09-27	Δ
Total workflows	298	298	0
Total secret refs	10,269	10,274	+5
GitHub token refs	1,919	1,919	0
Unique secret types	42	43	+1
Redaction coverage	298/298	298/298	0
Token cascade instances	1,011	1,011	0
Permission blocks	298	298	0

Top-3 secrets are unchanged in rank and near-identical in count (GITHUB_TOKEN 5325→5324, GH_AW_GITHUB_TOKEN 4544→4543, GH_AW_GITHUB_MCP_SERVER_TOKEN 1939→1939). The +1 net new unique secret type observed today has low occurrence count and no visible impact on the security posture checks.

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-09-27T17:43:41Z
Workflow: .github/workflows/daily-secrets-analysis.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 41.8 AIC · ⌖ 14.5 AIC · ⊞ 9.1K · ◷

• expires on Sep 30, 2026, 9:46 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #64057.