[daily secrets] 🔐 Secrets Analysis Report — 2026-06-13

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-06-13
Workflow Files Analyzed: 246
Run: §27474603932

---

📊 Executive Summary

Metric	Value
Total secrets.* References	6,868
github.token References	1,484
Unique Secret Types	39
Workflows Analyzed	246

GitHub token-family secrets dominate usage: GITHUB_TOKEN (3,653), GH_AW_GITHUB_TOKEN (3,230), and GH_AW_GITHUB_MCP_SERVER_TOKEN (1,351) together account for 96% of all secret references.

---

🛡️ Security Posture

Control	Status	Coverage
Secret Redaction Steps	✅ Present	246/246 (100%)
Permission Blocks	✅ Present	246/246 (100%)
Token Cascade Fallback	✅ Present	246/246 (100%)
Secrets in Job Outputs	✅ None Found	0 instances
Direct Template Injection (run: blocks)	✅ None confirmed	0 confirmed risks

All 246 workflows use the 3-part token cascade pattern (GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN), providing 2,092 instances of proper fallback resilience.

Note on permissions: {}: All workflows declare permissions: {} (empty block), which delegates to repository default permissions rather than specifying explicit least-privilege scopes. Consider moving to explicit permission scopes (e.g. contents: read) to enforce least-privilege.

---

🎯 Key Findings

1. Token Cascade Uniformity: 100% of workflows implement the MCP → custom PAT → GITHUB_TOKEN fallback chain, ensuring resilience to token unavailability.
2. Universal Redaction: Every compiled workflow includes redact_secrets integration, preventing accidental secret leakage in logs.
3. AI/LLM Key Footprint: 437 total AI provider secret references across 5 providers (Anthropic: 257, OpenAI: 79, Codex: 78, Gemini: 5, Others: 18). Anthropic dominates at 59% of AI key usage.
4. Observability Telemetry: OTEL secret references total ~1,860 across Sentry (1,163), Grafana (697), and Datadog (25) integrations.
5. False Positive Cleared: Initial scan flagged 5 files for github.event.* references in run: blocks. Deeper analysis confirmed these are all safe env: variable assignments, not direct shell interpolation.

---

💡 Recommendations

1. Adopt Explicit Permissions: Replace permissions: {} with specific scopes per workflow (e.g. contents: read, issues: write). This enforces least-privilege and prevents accidental over-permissioning.
2. Audit COPILOT_GITHUB_TOKEN: Used in 419 locations — validate whether all usages require this specialized token vs. the standard cascade.
3. Review DD_ Keys*: Datadog secrets (DD_API_KEY, DD_APPLICATION_KEY, DD_APP_KEY) appear in 25 references across separate keys — consider consolidating or confirming this is intentional deduplication.
4. Monitor AI Key Diversity: 5 different AI provider key types in use. Establish a rotation schedule and monitor for unused providers.

---

🔑 Top 15 Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	3,653	GitHub Token
2	GH_AW_GITHUB_TOKEN	3,230	GitHub Token (Custom PAT)
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	1,351	GitHub Token (MCP)
4	GH_AW_OTEL_SENTRY_AUTHORIZATION	697	Observability
5	GH_AW_OTEL_SENTRY_ENDPOINT	466	Observability
6	GH_AW_OTEL_GRAFANA_AUTHORIZATION	464	Observability
7	COPILOT_GITHUB_TOKEN	419	GitHub Token (Copilot)
8	ANTHROPIC_API_KEY	257	AI/LLM
9	GH_AW_OTEL_GRAFANA_ENDPOINT	233	Observability
10	OPENAI_API_KEY	79	AI/LLM
11	CODEX_API_KEY	78	AI/LLM
12	GH_AW_CI_TRIGGER_TOKEN	59	GitHub Token (CI)
13	GH_AW_SIDE_REPO_PAT	24	GitHub Token (Cross-repo)
14	TAVILY_API_KEY	13	External Integration
15	GH_AW_AGENT_TOKEN	13	GitHub Token (Agent)

🤖 AI/LLM Provider Breakdown

Provider	Secret	Occurrences
Anthropic	ANTHROPIC_API_KEY	257
OpenAI	OPENAI_API_KEY	79
Codex	CODEX_API_KEY	78
Sentry OpenAI	SENTRY_OPENAI_API_KEY	8
Foundry (endpoint)	FOUNDRY_OPENAI_ENDPOINT	6
Gemini	GEMINI_API_KEY	5
Foundry (key)	FOUNDRY_API_KEY	3
OpenRouter	OPENROUTER_API_KEY	1
Total		437

📡 Observability Telemetry Breakdown

Integration	Secret	Occurrences
Sentry	GH_AW_OTEL_SENTRY_AUTHORIZATION	697
Sentry	GH_AW_OTEL_SENTRY_ENDPOINT	466
Grafana	GH_AW_OTEL_GRAFANA_AUTHORIZATION	464
Grafana	GH_AW_OTEL_GRAFANA_ENDPOINT	233
Datadog	DD_APP_KEY + DD_APPLICATION_KEY	20
Datadog	DD_API_KEY	8
Datadog	DD_SITE	7
Total		1,895

🔗 External Integration Secrets

Integration	Secret	Occurrences
Tavily (search)	TAVILY_API_KEY	13
Notion	NOTION_API_TOKEN	6
Antigravity	ANTIGRAVITY_API_KEY	6
Brave (search)	BRAVE_API_KEY	4
Slack	SLACK_BOT_TOKEN	1
Total		30

☁️ Azure / Cloud Provider Secrets

Secret	Occurrences
AZURE_CLIENT_ID	(present)
AZURE_CLIENT_SECRET	(present)
AZURE_TENANT_ID	(present)
GRAFANA_SERVICE_ACCOUNT_TOKEN	(present)
GRAFANA_URL	(present)

📖 Reference Documentation

• Secrets specification: scratchpad/secrets-yml.md
• Redaction system: actions/setup/js/redact_secrets.cjs
• Token cascade patterns: standard across all compiled workflows

---

Generated: 2026-06-13T18:02:47Z
References: §27474603932

Generated by 🔒 Daily Secrets Analysis Agent · 140.8 AIC · ⌖ 14.3 AIC · ⊞ 18.7K · ◷

• expires on Jun 16, 2026, 10:05 AM UTC-08:00