[daily secrets] Daily Secrets Analysis Report

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-08-01
Workflow Files Analyzed: 266
Run: §30711317337

📊 Executive Summary

• Total Secret References: 8,755 (secrets.*)
• GitHub Token References: 2,011 (github.token)
• Unique Secret Types: 40
• Job-Level Usage: 0 (secrets are not injected at job-level env:)
• Step-Level Usage: 4,020 (~46% of total refs are inside step-level env:/run: blocks)

🛡️ Security Posture

✅ Redaction System: 266/266 workflows have redaction steps (100% coverage)
✅ Token Cascades: 955 instances of fallback chains (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN)
✅ Permission Blocks: 266 explicit permission definitions (one per workflow)
✅ Secrets in Outputs: 0 confirmed instances (initial grep flagged 33 lines, but a YAML-block-aware recheck confirmed these were false positives from non-adjacent text, not actual outputs: sections exposing secrets)
⚠️ github.event.* interpolation: 4,888 raw matches across lock files. Nearly all reside inside quoted env: variable assignments (the standard gh-aw safe-templating pattern), not direct unescaped shell/expression interpolation — consistent with the project's established mitigation for template injection. No new unmitigated direct-interpolation patterns were identified.

🎯 Key Findings

1. Token hierarchy dominates usage: GITHUB_TOKEN (4,403), GH_AW_GITHUB_TOKEN (3,765), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,752) together account for ~68% of all secret references, reflecting the standard token-cascade pattern used for GitHub API/MCP auth across nearly every workflow.
2. Full redaction coverage: Every one of the 266 compiled workflows includes a redact_secrets step, indicating consistent enforcement of the secret-redaction safeguard at compile time.
3. Observability secrets are common but scoped: OTEL/Sentry/Grafana auth+endpoint secrets (699+467+465+233 ≈ 1,864 refs) appear widely, which is expected for telemetry-enabled workflows but worth periodic review to confirm none over-broaden permissions.
4. No job-level secret env blocks: All secret usage occurs at the step level, which limits secret exposure scope compared to job-wide env: blocks — a good security practice already in place.

💡 Recommendations

1. Periodically audit OTEL/Sentry/Grafana secret scopes — with ~1,860 references, confirm these tokens are least-privilege and rotated per your policy.
2. Maintain the current step-level-only pattern for secret exposure; avoid introducing job-level env: secret blocks in new workflows to keep the current 0% job-level exposure.
3. Continue enforcing 100% redaction-step coverage as a required check in gh aw compile output validation, since it is currently perfect across all 266 files.

🔑 Top 10 Secrets by Usage

Rank	Secret Name	Occurrences	Type
1	GITHUB_TOKEN	4403	GitHub Token
2	GH_AW_GITHUB_TOKEN	3765	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1752	GitHub Token
4	COPILOT_GITHUB_TOKEN	768	GitHub Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	699	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	467	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	465	Observability
8	ANTHROPIC_API_KEY	283	LLM API Key
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	107	LLM API Key

📈 Trends

No historical baseline discussion was found to diff against — this is treated as the first tracked snapshot. Stats have been computed for future comparisons:

• total_workflows: 266
• secret_refs: 8755
• token_refs: 2011
• unique_secrets: 40
• redaction_count: 266
• cascade_count: 955

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-08-01T17:57:21Z
Workflow: .github/workflows/daily-secrets-analysis.md (or equivalent source workflow)

Generated by 🔒 Daily Secrets Analysis Agent · auto · 15.7 AIC · ⌖ 7.73 AIC · ⊞ 9.1K · ◷

• expires on Aug 4, 2026, 10:00 AM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #49822.