The Secrets hygiene page (Secrets in the sidebar) inventories your
organization’s GitHub Actions organization secrets and shows how long since
each was last rotated, flagging any that have gone stale.
GitHub never exposes secret values through its API — this reads metadata
only (name, visibility, and last-updated timestamp). Pipefort computes the
rotation age from the last-updated time and marks a secret stale when it
hasn’t been rotated in over 180 days.
What you see
Secrets are ordered riskiest-first: stale before fresh, oldest rotation first.
Requires the “Secrets: read” permission
Reading Actions secrets needs the GitHub App’s Secrets: read permission,
which is not part of the default install. Until it is granted — and each
installation re-consents to the added permission — this page shows a prompt to
grant it instead of an inventory.
Scope
This first version covers organization Actions secrets. Repository-level
secrets, per-secret usage mapping (which workflows reference a secret), and
OIDC adoption are planned follow-ups — they require analyzing each
repository’s workflows for ${{ secrets.* }} references and id-token: write
usage. 
