[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-29
Workflow Files Analyzed: 266
Run: §30477743812

📊 Executive Summary

• Total Secret References: 8,734 (secrets.*)
• GitHub Token References: 1,963 (github.token)
• Unique Secret Types: 40
• Redaction Coverage: 266/266 workflows (100%)
• Token Cascade Chains: 955 instances

🛡️ Security Posture

✅ Redaction System: 266/266 workflows have redact_secrets steps
✅ Token Cascades: 955 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback pattern
✅ Permission Blocks: 266/266 workflows define explicit permissions:
✅ No secrets in job/step outputs — the raw grep matched 33 lines, but manual inspection confirmed all matches are env: blocks (e.g. ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}) picked up by context overlap with an unrelated outputs: key, not real output exposure.
✅ No template injection risk — occurrences of github.event. are confined to env:-mediated variable assignment (the standard gh-aw safe pattern), not direct inline expression interpolation in run: scripts.

🎯 Key Findings

1. GITHUB_TOKEN and GH_AW_GITHUB_TOKEN dominate usage (4,397 + 3,764 references, ~93% of all secret refs), consistent with the token-cascade design used for GitHub API/MCP authentication across nearly every workflow.
2. LLM provider keys are well-isolated: ANTHROPIC_API_KEY (278), OPENAI_API_KEY (105), CODEX_API_KEY (104) — each scoped to specific engine steps, no cross-contamination observed.
3. Observability secrets are present but bounded: OTEL/Sentry/Grafana auth+endpoint secrets (699+467+465+233 refs) appear only in telemetry-related steps, not exposed elsewhere.
4. 100% redaction and permission-block coverage across all 266 lock files indicates consistent application of the compiler's security scaffolding — no workflow bypasses these controls.

💡 Recommendations

1. Maintain current cascade pattern: Continue using the GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback for new workflows to preserve least-privilege token scoping.
2. Monitor growth of GH_AW_SIDE_REPO_PAT and GH_AW_AGENT_TOKEN (24 and 15 refs respectively) — these are broader-scope PATs; ensure they remain limited to workflows that genuinely require cross-repo access.
3. No immediate action needed — posture is stable with full redaction/permission coverage; continue running this daily scan to catch regressions early.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4,397	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,764	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,752	GitHub Token
4	COPILOT_GITHUB_TOKEN	761	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	278	LLM Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	105	LLM Provider

📈 Trends

No prior daily-secrets snapshot was found to diff against — this establishes the baseline for future comparisons. Baseline stats:

• Total workflows: 266
• Total secret refs: 8,734
• Token refs: 1,963
• Unique secret types: 40
• Redaction count: 266
• Cascade count: 955

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-07-29T18:00 UTC
Workflow: Daily Secrets Analysis Agent

Generated by 🔒 Daily Secrets Analysis Agent · aut00 · 18.5 AIC · ⌖ 7.51 AIC · ⊞ 9K · ◷

• expires on Aug 1, 2026, 10:03 AM UTC-08:00