[daily secrets] 🔐 Daily Secrets Analysis Report — 2026-07-13

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-13
Workflow Files Analyzed: 257
Run: §29273522276

---

📊 Executive Summary

Metric	Value
Total secrets.* references	8,398
github.token references	1,571
Unique secret types	40
Workflows with redaction steps	257/257
Token cascade patterns	926
Explicit permissions: blocks	257/257

---

🛡️ Security Posture

✅ Redaction System: 100% of workflows (257/257) include redact_secrets steps — full coverage
✅ Token Cascades: 926 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN fallback chains — least-privilege ordering confirmed
✅ Permission Blocks: 100% of workflows (257/257) define explicit permissions: — no implicit permission escalation
✅ No Secrets in Run Steps: github.event.* references only appear in env: variable assignments — no direct shell interpolation
✅ No Secrets in Job Outputs: Confirmed zero secret values exposed through job output mappings
⚠️ Secrets Passed via with:secrets:: 33 instances where secrets are forwarded through job with: blocks — expected pattern for reusable workflows, but warrants periodic review

---

🎯 Key Findings

1. GitHub Token Dominance: GITHUB_TOKEN (4,254) and GH_AW_GITHUB_TOKEN (3,630) together account for ~93% of all secret references — consistent with a GitHub-native agentic platform
2. AI Provider Diversity: 40 unique secret types span 8+ AI providers (Anthropic, OpenAI, Codex, Gemini, OpenRouter, Foundry, Brave, Tavily) — broad model coverage but increases secret rotation surface
3. Observability Stack Secrets: Sentry, Grafana, and Datadog secrets appear across many workflows (698 + 464 + 8 occurrences) — monitoring infrastructure is deeply integrated
4. github.event.* Pattern Volume: 4,593 references to github.event.* — all safely assigned to env: variables before use (no shell injection risk detected)
5. Reusable Workflow Secret Forwarding: The 33 with:secrets: forwarding instances are the expected pattern for called reusable workflows; values are correctly passed as secret references, not plaintext

---

💡 Recommendations

1. Secret Rotation Surface: With 40 unique secret types across 8+ AI providers, ensure rotation schedules are documented and automated — high volume increases blast radius if any single key is compromised
2. Reusable Workflow Audit: Periodically review the 33 secret-forwarding with: blocks to ensure least-privilege — only forward secrets actually needed by called workflows
3. Azure Credential Scope: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, and AZURE_TENANT_ID each appear only 2 times — verify these are appropriately scoped and not over-permissioned for their limited usage

---

🔑 All 40 Secrets by Usage Count

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,254	GitHub Auth
2	GH_AW_GITHUB_TOKEN	3,630	GitHub Auth
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,696	GitHub Auth
4	COPILOT_GITHUB_TOKEN	705	GitHub Auth
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	698	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	466	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	464	Observability
8	ANTHROPIC_API_KEY	242	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability
10	OPENAI_API_KEY	81	AI Provider
11	CODEX_API_KEY	80	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	60	CI/CD
13	GH_AW_SIDE_REPO_PAT	24	GitHub Auth
14	GH_AW_AGENT_TOKEN	15	GitHub Auth
15	TAVILY_API_KEY	12	AI Provider
16	SENTRY_OPENAI_API_KEY	10	Observability
17	SENTRY_ACCESS_TOKEN	10	Observability
18	DD_APP_KEY	10	Observability
19	DD_APPLICATION_KEY	10	Observability
20	DD_API_KEY	8	Observability
21	DD_SITE	7	Observability
22	NOTION_API_TOKEN	6	Integration
23	GRAFANA_URL	6	Observability
24	GRAFANA_SERVICE_ACCOUNT_TOKEN	6	Observability
25	FOUNDRY_OPENAI_ENDPOINT	6	AI Provider
26	ANTIGRAVITY_API_KEY	6	Integration
27	GH_AW_PROJECT_GITHUB_TOKEN	5	GitHub Auth
28	GEMINI_API_KEY	5	AI Provider
29	BRAVE_API_KEY	4	AI Provider
30	AWI_MAINTENANCE_TOKEN	4	CI/CD
31	FOUNDRY_API_KEY	3	AI Provider
32	GH_AW_OTEL_DATADOG_API_KEY	2	Observability
33	CONTEXT	2	Other
34	AZURE_TENANT_ID	2	Cloud Auth
35	AZURE_CLIENT_SECRET	2	Cloud Auth
36	AZURE_CLIENT_ID	2	Cloud Auth
37	SLACK_BOT_TOKEN	1	Integration
38	OPENROUTER_API_KEY	1	AI Provider
39	GH_AW_OTEL_DATADOG_ENDPOINT	1	Observability
40	GH_AW_OTEL_GRAFANA_ENDPOINT	232	Observability

🤖 AI Provider Coverage (Workflows Using Each Key)

Provider	Secret	Workflows
Anthropic	ANTHROPIC_API_KEY	62
OpenAI	OPENAI_API_KEY	15
Codex	CODEX_API_KEY	14
Tavily	TAVILY_API_KEY	5
Gemini	GEMINI_API_KEY	2
Brave	BRAVE_API_KEY	2
Foundry	FOUNDRY_API_KEY	1
OpenRouter	OPENROUTER_API_KEY	1

📖 Reference Documentation

• Redaction System: actions/setup/js/redact_secrets.cjs
• Secret specification: scratchpad/secrets-yml.md

---

Generated: 2026-07-13 18:15 UTC
Workflow Run: §29273522276

Generated by 🔒 Daily Secrets Analysis Agent · 25.1 AIC · ⌖ 8.55 AIC · ⊞ 6.2K · ◷

• expires on Jul 16, 2026, 10:19 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #45534.