On GitHub, the Read and Triage roles have no access to Actions secrets and variables. Write, Maintain and Admin can create, update and delete them. If you hand out Write freely, you have handed out secret management on that repository too, so scope secrets with that in mind.
What the role table says
GitHub's repository role documentation lists Actions secrets and variables as a separate row. Read and Triage have none. Write, Maintain and Admin can manage them.
That includes the people you added for a quick fix last spring. If your Write list is long, so is the list of people who can replace a secret value, and a workflow can use a secret it can reach.
Three ways to shrink the exposure
- Move high value secrets, such as production deploy credentials, out of repository level secrets and into environments with required reviewers.
- Use short lived credentials issued at run time where your cloud supports them, so the stored secret is a trust relationship rather than a key.
- Split repositories by sensitivity. A repo that builds a marketing site should not share a team with the repo that deploys payments.
None of these needs a new tool. They need an afternoon and a list of the secrets you actually have.
Run the inventory
- List repositories and note which have Actions secrets.
- For each, list who has Write or above, through teams and direct grants.
- Mark secrets that reach production or customer data.
- Rotate any secret that a departed person could have read.
- Record the date and the reviewer.
Running this once a quarter turns a vague worry into a dated record, and it is the sort of evidence access reviews ask for.
What roles do not solve
Roles do not stop a malicious or compromised workflow from printing a secret into logs, and they do not limit what a pull request from a fork can see. For those, use read only default token permissions, require review for workflow file changes, and keep secrets out of jobs that run untrusted code. Review those settings alongside the role list, because the two together decide how far one stolen account can reach.
Where Safeguard fits
Safeguard scans dependencies and builds an SBOM, and its policies and gates can block a pull request that adds a known-vulnerable package. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the demo and see how findings get prioritized, then ask which of your own secrets would rank first if they leaked.
Click through it at your own pace, or open it full screen.
Quick check
Can Triage see secret values?
No. GitHub lists no secrets access for Read and Triage.
Does Maintain include secrets?
Yes, according to the role table Maintain can manage Actions secrets and variables.
Sources
Last reviewed: 19 October 2026.
