StepSecurity has added new capabilities to its Actions Secret dashboard that help organizations identify unused, stale, and OIDC-replaceable GitHub Actions secrets across all repositories. The update provides usage tracking showing which workflows reference each secret, when they last ran, and which secrets can be eliminated by switching to OIDC authentication (e.g., for AWS, GCP, Azure, npm, PyPI). The feature categorizes secrets as Active, Stale (no workflow run in 90+ days), Unused, or Unknown, and flags credentials that could be replaced with short-lived OIDC tokens. Context is provided by real-world attacks like GhostAction and Megalodon, which exfiltrated thousands of secrets from GitHub repositories. The feature is available on StepSecurity's Enterprise tier.
