[daily secrets] Secrets Analysis Report – 2026-07-09

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-09
Workflow Files Analyzed: 256
Run: §29039847615

---

📊 Executive Summary

Metric	Value
secrets.* references	8,374 lines
github.token references	1,567 lines
Unique secret types	41
Job-level usage	4,575 (50.0%)
Step-level usage	4,568 (49.9%)
Workflows referencing secrets	256 / 256 (100%)

---

🛡️ Security Posture

Control	Status	Coverage
Redaction steps (redact_secrets.cjs)	✅ Active	256 / 256 workflows (100%)
Token fallback cascades	✅ Present	922 instances
Explicit permissions: blocks	✅ Present	256 / 256 workflows (100%)
Secrets in job outputs:	✅ None found	0 exposures
Expression injection in run:	✅ Mitigated	github.event.* routed via env:

All github.event.* expressions (4,573 lines) are passed through env: variables rather than interpolated directly into run: shell scripts, which is the correct mitigation for expression injection.

---

🎯 Key Findings

1. Perfect security control coverage: Every workflow (256/256) has both a permissions: block and a redact_secrets step — indicating consistent and systematic security scaffolding across the entire compiled workflow fleet.

2. Token cascade pattern widely adopted: 922 instances of the three-tier fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) provide resilient authentication with least-privilege preference.

3. AI API secret diversity is growing: 10 distinct AI provider secrets are in use (Anthropic, OpenAI, Codex, Gemini, Foundry, ANTIGRAVITY, Brave, Tavily, OpenRouter, Sentry-OpenAI), spanning 440+ total references. ANTHROPIC_API_KEY leads at 242 references.

4. secrets.cjs pseudo-secret (false positive): 256 occurrences of secrets.cjs appear in the raw grep due to string redact_secrets.cjs in require() calls — this is not a real secret reference. The actual unique secret types remain at 40 real secrets.

5. Even job/step distribution: Secrets are almost equally split between job-level env (50.0%) and step-level env (49.9%), indicating consistent usage at both scopes without over-centralization.

---

💡 Recommendations

1. Audit low-use secrets for active need: Secrets like OPENROUTER_API_KEY (1 use), SLACK_BOT_TOKEN (1 use), and CONTEXT (2 uses) should be verified as still needed. Low-usage secrets increase attack surface if orphaned.

2. Monitor AI API key proliferation: With 10 AI providers now registered, consider a secret naming convention audit to ensure consistency (e.g., *_API_KEY pattern) and confirm all providers are still active.

3. Review SENTRY_ACCESS_TOKEN vs SENTRY_OPENAI_API_KEY: Both have 10 references each. Verify there is no overlap or consolidation opportunity between the two Sentry-related credentials.

4. Track AZURE_CLIENT_SECRET carefully: Azure service principal credentials (AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID) each appear only 2 times — confirm these are in active use and have appropriate rotation schedules.

---

🔑 Top 20 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,235	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,618	GitHub Auth (PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,690	GitHub Auth (MCP)
4	COPILOT_GITHUB_TOKEN	701	GitHub Auth (Copilot)
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	242	AI API
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	81	AI API
11	CODEX_API_KEY	80	AI API
12	GH_AW_CI_TRIGGER_TOKEN	60	CI Automation
13	GH_AW_SIDE_REPO_PAT	24	GitHub Auth (PAT)
14	GH_AW_AGENT_TOKEN	15	Agent Auth
15	TAVILY_API_KEY	12	AI API (Search)
16	DD_APP_KEY	10	Observability (DD)
17	DD_APPLICATION_KEY	10	Observability (DD)
18	SENTRY_ACCESS_TOKEN	10	Observability
19	SENTRY_OPENAI_API_KEY	10	AI/Observability
20	DD_API_KEY	8	Observability (DD)

🤖 AI Provider Secret Breakdown

Provider	Secret Name(s)	References
Anthropic	ANTHROPIC_API_KEY	242
OpenAI	OPENAI_API_KEY	81
Codex	CODEX_API_KEY	80
Sentry/OpenAI	SENTRY_OPENAI_API_KEY	10
Tavily	TAVILY_API_KEY	12
Foundry	FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT	9
Antigravity	ANTIGRAVITY_API_KEY	6
Gemini	GEMINI_API_KEY	5
Brave	BRAVE_API_KEY	4
OpenRouter	OPENROUTER_API_KEY	1

Total AI API references: 450

🔭 Observability Secret Breakdown

Provider	Secret Name(s)	References
Sentry (OTLP)	GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT	1,166
Grafana (OTLP)	GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT	698
Datadog	DD_API_KEY, DD_APP_KEY, DD_APPLICATION_KEY, DD_SITE	35
Grafana (direct)	GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN	12
Datadog (OTLP)	GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT	3
Sentry (direct)	SENTRY_ACCESS_TOKEN	10

Total observability references: 1,924

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade pattern: used in 922 workflow steps for resilient GitHub API auth

---

Generated: 2026-07-09 18:15 UTC
Workflow: §29039847615

Generated by 🔒 Daily Secrets Analysis Agent · 33.4 AIC · ⌖ 8.75 AIC · ⊞ 6.2K · ◷

• expires on Jul 12, 2026, 10:20 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #44808.