[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-10-02 | Workflow Files Analyzed: 301 | Run: 37042399679

📊 Executive Summary

• Total Secret References: 10,356 (secrets.* lines)
• GitHub Token References: 1,950 (github.token)
• Unique Secret Types: 43
• Job-level vs step-level split not computed (the heuristic grep is unreliable).

🛡️ Security Posture

✅ Redaction: 301/301 workflows have redaction steps
✅ Token Cascades: 1,023 fallback chain instances
✅ Permission Blocks: 301 top-level permissions: blocks (one per workflow)
✅ Template injection (TestCompiledLockFiles_NoGitHubEventExpressionsInRunScripts): passed
✅ Secrets in job outputs (TestCompiledLockFiles_NoSecretsInOutputs): passed

🎯 Key Findings

1. Every workflow has redaction and explicit permissions.
2. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage, as expected from the cascades.
3. Telemetry secrets (GH_AW_OTEL_*) are widely referenced (~500–750 each), a notable share of all references.

💡 Recommendations

1. Keep the CI tests for template injection and secrets in outputs mandatory.
2. Review the scope of the OTEL authorization secrets, as they are present in many workflows.
3. Persist daily stats (for example in cache-memory) so trend comparison is possible. No previous-day data was available.

🔑 Top 9 Secrets by Usage

Rank	Secret	Occurrences
1	GITHUB_TOKEN	5375
2	GH_AW_GITHUB_TOKEN	4586
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1960
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	744
5	COPILOT_GITHUB_TOKEN	520
6	GH_AW_OTEL_SENTRY_ENDPOINT	497
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	495
8	OPENAI_API_KEY	398
9	CODEX_API_KEY	397

The 10th entry is an artifact: a bare secrets. match with an empty name, 10,356 hits. It was excluded from the table.

📈 Trends

No historical data available.

Generated by 🔒 Daily Secrets Analysis Agent · copilot · auto · 11.8 AIC · ⌖ 14.3 AIC · ⊞ 9.1K · ◷

• expires on Oct 5, 2026, 9:48 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #65385.