[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-10-01 | Workflow Files Analyzed: 301 | Run: 36901375383

📊 Executive Summary

• Total Secret References: 10,356 lines (secrets.*)
• GitHub Token References: 1,950 (github.token)
• Unique Secret Types: 43 (some name matches are partial, e.g. dynamic secrets. expressions)
• Job-level vs step-level split not computed (the grep heuristic is unreliable on 301 files).

🛡️ Security Posture

✅ Redaction: 301/301 workflows have redaction steps
✅ Token cascades: 1,023 fallback chains
✅ Permission blocks: 301 explicit definitions
✅ Template injection: TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts passed
✅ Secrets in job outputs: TestCompiledLockFiles_NoSecretsInOutputs passed

🎯 Key Findings

1. Redaction and permission coverage are complete (301/301).
2. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage (about 96% of the top-10 volume).
3. OTEL secrets (Sentry, Grafana) appear widely, with 744 and 495 references.
4. No previous-day stats were available, so no trend comparison.

💡 Recommendations

1. Keep both CI checks enforced.
2. Persist daily stats so future runs can report trends.

🔑 Top 10 Secrets by Usage

Rank	Secret	Occurrences
1	GITHUB_TOKEN	5376
2	GH_AW_GITHUB_TOKEN	4587
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1960
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744
5	COPILOT_GITHUB_TOKEN	520
6	GH_AW_OTEL_SENTRY_ENDPOINT	497
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495
8	OPENAI_API_KEY	398
9	CODEX_API_KEY	397
10	(dynamic secrets. expressions)	341

Specification: scratchpad/secrets-yml.md

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 11.5 AIC · ⌖ 9.27 AIC · ⊞ 9.1K · ◷

• expires on Oct 4, 2026, 9:49 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #65074.