# Workflow runs and secrets at risk

2026-10-07 · New

For each incident, Depi lists the GitHub workflow runs from the exposure window, the secrets they could read and the permissions their tokens held.

When a compromised package or action runs in CI, you need to know what it could
reach. Depi now tracks the secrets and permissions of the GitHub workflows an
incident touches in order to facilitate incident response.

Depi looks at every workflow that ran during the incident window and matches it
against the project's secrets and access. The new **Workflow runs** tab shows the result:
what may be compromised, and what you may need to rotate.

![The Workflow Runs tab of the tj-actions/changed-files incident, with five secrets at risk, four write permissions, runs grouped by project and one run open in the side panel](https://depi.security/_astro/workflow-runs.DmdCQJ0k_RN8nO.webp)

## Declared secrets and secrets at risk

Depi keeps two lists apart:

- **Declared secrets**: a step in this workflow explicitly reads them by name.
- **Secrets at risk**: all the secrets that the workflow can read.

In this example, checkout-api still uses a long-lived AWS key, and four of its
runs could read it:

![The run list filtered to the four checkout-api runs that could read AWS_SECRET_ACCESS_KEY](https://depi.security/_astro/filter-by-secret.C6X8vbPE_22lxiM.webp)

## Pipeline secrets

Depi re-uses the same logic in the reworked Project pipelines view, which should
bring more clarity on what secrets and permissions a pipeline has.

![The Deploy pipeline: one declared secret, four secrets at risk, and write access to packages, deployments and id-token](https://depi.security/_astro/pipeline-secrets.IZk7pbve_lNof4.webp)