> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pipefort.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Secrets hygiene

> Inventory your organization's GitHub Actions secrets with rotation age, and flag stale ones.

The **Secrets hygiene** page (**Secrets** in the sidebar) inventories your
organization's **GitHub Actions organization secrets** and shows how long since
each was last rotated, flagging any that have gone stale.

GitHub never exposes secret **values** through its API — this reads **metadata
only** (name, visibility, and last-updated timestamp). Pipefort computes the
rotation age from the last-updated time and marks a secret **stale** when it
hasn't been rotated in over **180 days**.

## What you see

| Column           | Meaning                                                      |
| ---------------- | ------------------------------------------------------------ |
| **Secret**       | The secret's name (never its value).                         |
| **Organization** | The GitHub org the secret belongs to.                        |
| **Visibility**   | `all`, `private`, or `selected` — which repos can use it.    |
| **Last rotated** | How long since the secret was last set/updated.              |
| **Status**       | **Stale** if not rotated in over 180 days, otherwise **OK**. |

Secrets are ordered riskiest-first: stale before fresh, oldest rotation first.

## Requires the "Secrets: read" permission

<Warning>
  Reading Actions secrets needs the GitHub App's **Secrets: read** permission,
  which is **not** part of the default install. Until it is granted — and each
  installation re-consents to the added permission — this page shows a prompt to
  grant it instead of an inventory.
</Warning>

To enable the inventory, add **Secrets → Read-only** to the Pipefort GitHub App
and approve the updated permission on your installation. Pipefort only ever
reads secret **metadata**; it cannot read secret values, and GitHub does not
expose them.

## Scope

This first version covers **organization** Actions secrets. Repository-level
secrets, per-secret **usage mapping** (which workflows reference a secret), and
**OIDC** adoption are planned follow-ups — they require analyzing each
repository's workflows for `${{ secrets.* }}` references and `id-token: write`
usage.