[daily secrets] Secrets Analysis Report – 2026-07-21

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-07-21
Workflow Files Analyzed: 260
Run: §29855290081

📊 Executive Summary

Metric	Value
Total secrets.* references	8,574
github.token references	1,839
Unique secret types	41
Token cascade (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) usages	933

🛡️ Security Posture

Control	Status
Redaction steps	✅ 260/260 (100%) workflows have redact_secrets
Permission blocks	✅ 260/260 (100%) workflows define explicit permissions:
Token fallback chains	✅ 933 cascade patterns for graceful token fallback
Secrets exposed in run: blocks	✅ 0 direct github.event.* interpolations in run steps
Secrets in job outputs:	✅ No confirmed secret values found in job outputs

🎯 Key Findings

1. Complete security baseline: All 260 compiled workflows include both redact_secrets steps and explicit permissions: blocks — full coverage.
2. Token cascade pattern is pervasive: 933 instances of the three-level fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN) provides robust token-availability guarantees.
3. github.token widely used: 1,839 github.token references alongside 4,298 secrets.GITHUB_TOKEN uses — both patterns are standard and expected in this repo.
4. 41 unique secret types: Mix of infra (OTEL/Datadog/Grafana/Sentry), AI providers (Anthropic, OpenAI, Gemini, Codex, Foundry), and GitHub tokens.
5. Handlebars compile artifacts: 4,072 github.event.* patterns appear in Handlebars template strings inside compiled YAML ({{#if ...}}); these are template source text, not executable expressions — no injection risk.

💡 Recommendations

1. Monitor AI provider key count: 6 distinct AI-provider secret types (ANTHROPIC, OPENAI, CODEX, GEMINI, FOUNDRY, OPENROUTER, SENTRY_OPENAI) — consider an audit of which workflows need multiple providers vs. a gateway pattern.
2. Track DD_APP_KEY vs DD_APPLICATION_KEY duplication: Both appear separately (10 refs each). Confirm these are intentional aliases or consolidate.
3. CONTEXT secret (2 refs): Unusual name — verify it is not a plain-text passthrough of sensitive data.

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	4,298	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,677	GitHub Token (PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,713	MCP Server Token
4	COPILOT_GITHUB_TOKEN	748	Copilot Token
5	GH_AW_OTEL_SENTRY_AUTHORIZATION	702	Observability
6	GH_AW_OTEL_SENTRY_ENDPOINT	469	Observability
7	GH_AW_OTEL_GRAFANA_AUTHORIZATION	467	Observability
8	ANTHROPIC_API_KEY	272	AI Provider
9	GH_AW_OTEL_GRAFANA_ENDPOINT	234	Observability
10	OPENAI_API_KEY	103	AI Provider
11	CODEX_API_KEY	102	AI Provider
12	GH_AW_CI_TRIGGER_TOKEN	59	CI Token
13	GH_AW_SIDE_REPO_PAT	24	GitHub PAT
14	GH_AW_AGENT_TOKEN	15	Agent Token
15	TAVILY_API_KEY	12	AI Provider

📦 Full Secret Inventory (41 unique types)

GitHub Tokens (6): GITHUB_TOKEN, GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN, COPILOT_GITHUB_TOKEN, GH_AW_AGENT_TOKEN, GH_AW_PROJECT_GITHUB_TOKEN

CI/Automation Tokens (3): GH_AW_CI_TRIGGER_TOKEN, GH_AW_SIDE_REPO_PAT, AWI_MAINTENANCE_TOKEN

AI Providers (9): ANTHROPIC_API_KEY, OPENAI_API_KEY, CODEX_API_KEY, GEMINI_API_KEY, FOUNDRY_API_KEY, FOUNDRY_OPENAI_ENDPOINT, OPENROUTER_API_KEY, BRAVE_API_KEY, TAVILY_API_KEY

Observability / OTEL (9): GH_AW_OTEL_SENTRY_AUTHORIZATION, GH_AW_OTEL_SENTRY_ENDPOINT, GH_AW_OTEL_GRAFANA_AUTHORIZATION, GH_AW_OTEL_GRAFANA_ENDPOINT, GH_AW_OTEL_DATADOG_API_KEY, GH_AW_OTEL_DATADOG_ENDPOINT, DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY

Sentry (3): SENTRY_ACCESS_TOKEN, SENTRY_OPENAI_API_KEY, DD_SITE

Grafana (2): GRAFANA_SERVICE_ACCOUNT_TOKEN, GRAFANA_URL

Azure (3): AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID

Misc (6): NOTION_API_TOKEN, SLACK_BOT_TOKEN, AI_GATEWAY_API_KEY, ANTIGRAVITY_API_KEY, CONTEXT, GH_AW_OTEL_DATADOG_ENDPOINT

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Workflow run: §29855290081

---

Generated: 2026-07-21 18:02 UTC

Generated by 🔒 Daily Secrets Analysis Agent · sonnet46 22.3 AIC · ⌖ 8.07 AIC · ⊞ 6.3K · ◷

• expires on Jul 24, 2026, 10:05 AM UTC-08:00