[daily secrets] Daily Secrets Analysis - 2026-03-16

[github-actions[bot]]

🔐 Daily Secrets Analysis Report

Date: 2026-03-16
Workflow Files Analyzed: 172
Run: §23163421976

---

📊 Executive Summary

Metric	Value
Workflow files scanned	172
Total secrets.* references	5,750
github.token references	520
Unique secret types	27
Workflows with redaction	172 / 172 (100%)
Token cascade usages	640
Explicit permission blocks	172 / 172 (100%)

The repository maintains 100% security coverage — every compiled workflow has both redaction steps and explicit permission declarations.

---

🛡️ Security Posture

✅ Redaction System: 172/172 workflows include redact_secrets.cjs — full coverage
✅ Token Cascades: 640 instances of GH_AW_GITHUB_MCP_SERVER_TOKEN || GH_AW_GITHUB_TOKEN || GITHUB_TOKEN fallback chains
✅ Permission Blocks: 172/172 explicit permissions: declarations
✅ No Secrets in Outputs: Zero instances of secrets exposed via job outputs
✅ github.event.* Usage: All 172 files use github.event.* in env: blocks to pass event context — this is expected, safe workflow behavior (e.g., issue numbers, PR numbers, comment IDs)

---

🎯 Key Findings

1. GitHub Token Triad Dominates: The top 3 secrets (GITHUB_TOKEN: 2,025 · GH_AW_GITHUB_TOKEN: 1,978 · GH_AW_GITHUB_MCP_SERVER_TOKEN: 980) account for 86% of all secret references. These are all GitHub access tokens using the established cascade fallback pattern.

2. AI Engine Secrets Well-Contained: AI engine API keys (ANTHROPIC_API_KEY: 164 · OPENAI_API_KEY: 90 · CODEX_API_KEY: 90 · GEMINI_API_KEY: 4) are present only in the workflows that need them — no evidence of over-provisioning.

3. Specialized Integrations Low Footprint: Third-party service secrets (Sentry, Datadog, Slack, Brave, Notion, Tavily) each appear in ≤15 workflows, confirming appropriate scope isolation.

4. COPILOT_GITHUB_TOKEN: Present in 295 references across workflows — this purpose-specific token for Copilot inference is well-separated from the general GitHub token pool.

---

💡 Recommendations

1. Monitor GH_AW_BOT_DETECTION_TOKEN: Only 1 occurrence detected — verify this is intentional and the workflow using it is correctly scoped.
2. Azure Secret Cluster: AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_TENANT_ID each appear exactly twice — confirm these are in the same workflow and not duplicated unnecessarily.
3. SLACK_BOT_TOKEN: Single occurrence — low risk but ensure the workflow referencing it has minimal permissions.
4. Maintain 100% Redaction Coverage: As new workflows are compiled, verify the redaction step continues to be auto-injected for all new lock files.

---

🔑 All Secrets by Usage

Rank	Secret Name	Occurrences	Category
1	GITHUB_TOKEN	2,025	GitHub Token
2	GH_AW_GITHUB_TOKEN	1,978	GitHub Token
3	GH_AW_GITHUB_MCP_SERVER_TOKEN	980	GitHub MCP Token
4	COPILOT_GITHUB_TOKEN	295	Copilot Inference
5	ANTHROPIC_API_KEY	164	AI Engine
6	OPENAI_API_KEY	90	AI Engine
7	CODEX_API_KEY	90	AI Engine
8	GH_AW_CI_TRIGGER_TOKEN	39	CI Automation
9	GH_AW_SIDE_REPO_PAT	19	Cross-repo Access
10	TAVILY_API_KEY	15	Web Search
11	GH_AW_PROJECT_GITHUB_TOKEN	8	GitHub Project
12	NOTION_API_TOKEN	6	Notion Integration
13	GH_AW_AGENT_TOKEN	6	Agent Auth
14	GEMINI_API_KEY	4	AI Engine
15	BRAVE_API_KEY	4	Web Search
16	DD_SITE	3	Datadog
17	DD_APPLICATION_KEY	3	Datadog
18	DD_API_KEY	3	Datadog
19	SENTRY_OPENAI_API_KEY	2	Sentry AI
20	SENTRY_ACCESS_TOKEN	2	Sentry
21	CONTEXT7_API_KEY	2	Context7 MCP
22	AZURE_TENANT_ID	2	Azure
23	AZURE_CLIENT_SECRET	2	Azure
24	AZURE_CLIENT_ID	2	Azure
25	SLACK_BOT_TOKEN	1	Slack
26	GH_AW_BOT_DETECTION_TOKEN	1	Bot Detection

📈 Trends

This is the first daily secrets analysis run for this period — no prior baseline available for comparison. Future runs will track:

• Delta in total secret references
• New secret types introduced
• Secrets that have been removed
• Changes to redaction/permission coverage

📖 Reference Documentation

For detailed information about secret usage patterns, see:

• Redaction System: actions/setup/js/redact_secrets.cjs
• Compiled Workflows: .github/workflows/*.lock.yml

---

References:

• §23163421976

AI generated by Daily Secrets Analysis Agent · history

• expires on Mar 19, 2026, 8:08 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Daily Secrets Analysis Agent.

A newer discussion is available at Discussion #21442.