[daily secrets] Daily Secrets Analysis — 2026-04-20

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-04-20
Workflow Files Analyzed: 197
Run: §24693456039

---

📊 Executive Summary

Metric	Value
secrets.* references	7,042
github.token references	793
Unique secret types	29
Workflows analyzed	197

Secret Category Breakdown

Category	Secrets	References	% of Total
🔑 GitHub Tokens	5	6,354	90.2%
🤖 AI API Keys	7	367	5.2%
📡 Observability	7	227	3.2%
🏗️ Infrastructure	5	89	1.3%
🔌 Integrations	6	15	0.2%

---

🛡️ Security Posture

✅ Redaction Coverage: 197/197 workflows (100%) include secret redaction steps
✅ Token Cascades: 739 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 197/197 workflows (100%) have explicit permission definitions
✅ Least-Privilege Read: 197/197 workflows (100%) include contents: read
✅ No Secrets in Job Outputs: Verified — no secrets values are directly exposed in job output fields

⚠️ Write Permissions: 82/197 workflows (41.6%) require write permissions — expected for agentic workflows that create issues, PRs, or comments

---

🎯 Key Findings

1. Near-universal redaction coverage: Every single compiled workflow includes a redaction step. This is excellent hygiene and prevents accidental secret exposure in logs.

2. Token cascade pattern is consistent: The 3-tier fallback chain (GH_AW_GITHUB_MCP_SERVER_TOKEN → GH_AW_GITHUB_TOKEN → GITHUB_TOKEN) appears 739 times across 197 workflows, ensuring resilient GitHub API access without hardcoded tokens.

3. GitHub tokens dominate usage (90.2%): The majority of secret references are GitHub authentication tokens, which is expected. AI API keys represent only 5.2%.

4. No secrets exposed in job outputs: A Python-based precise check confirmed that no workflow passes secret values through job-level output fields (which would be visible in the Actions UI).

5. CONTEXT7_API_KEY is a new/minor integration: Only 2 references, suggesting it's used in a small number of specialized workflows.

---

💡 Recommendations

1. Monitor write-permission workflows: 82 workflows have write permissions. Consider auditing these periodically to ensure they follow the principle of least privilege.

2. Review AZURE_ and SENTRY_ usage**: These secrets appear in only 2 workflows each. Confirm they are still actively used and consider removing them if no longer needed.

3. Consider SLACK_BOT_TOKEN audit: Only 1 reference — verify this integration is still active and the secret is rotated regularly.

---

🔑 Full Secret Inventory (29 unique secrets)

GitHub Authentication

Secret	References
GITHUB_TOKEN	2,507
GH_AW_GITHUB_TOKEN	2,419
GH_AW_GITHUB_MCP_SERVER_TOKEN	1,105
COPILOT_GITHUB_TOKEN	315
GH_AW_PROJECT_GITHUB_TOKEN	8

AI API Keys

Secret	References
ANTHROPIC_API_KEY	224
OPENAI_API_KEY	60
CODEX_API_KEY	60
TAVILY_API_KEY	13
GEMINI_API_KEY	4
BRAVE_API_KEY	4
SENTRY_OPENAI_API_KEY	2

Observability / Monitoring

Secret	References
GH_AW_OTEL_ENDPOINT	159
GH_AW_OTEL_HEADERS	53
DD_API_KEY	3
DD_APPLICATION_KEY	3
DD_SITE	3
SENTRY_API_KEY	2
SENTRY_ACCESS_TOKEN	2

Infrastructure

Secret	References
GH_AW_CI_TRIGGER_TOKEN	46
GH_AW_SIDE_REPO_PAT	19
GH_AW_AGENT_TOKEN	15
GH_AW_PROJECT_GITHUB_TOKEN	8
GH_AW_PLUGINS_TOKEN	1

Third-Party Integrations

Secret	References
NOTION_API_TOKEN	6
CONTEXT7_API_KEY	2
AZURE_CLIENT_ID	2
AZURE_CLIENT_SECRET	2
AZURE_TENANT_ID	2
SLACK_BOT_TOKEN	1

📈 Trend Baseline (first run)

This is the baseline run. Future reports will compare against this data.

Metric	Baseline (2026-04-20)
Workflow files	197
secrets.* references	7,042
github.token references	793
Unique secret types	29
Workflows with redaction	197 (100%)
Token cascades	739
Workflows with write perms	82

📖 Reference Documentation

• Specification: scratchpad/secrets-yml.md
• Redaction System: actions/setup/js/redact_secrets.cjs

---

Generated: 2026-04-20T22:26:13Z
Workflow: §24693456039

Generated by Daily Secrets Analysis Agent · ● 400.2K · ◷

• expires on Apr 23, 2026, 10:28 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #27704.