> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# GH_CanAccessSecret

> [Computed] Workflow job execution context can access a statically referenced secret — GH_WorkflowJob → GH_RepoSecret / GH_OrgSecret / GH_EnvironmentSecret

![Applies to BloodHound Enterprise and CE](https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max\&auto=format\&n=tTIczgde9H07oLXf\&q=85\&s=ad49a576589f4d2a8081df77d07fdf56)

## Edge Schema

* Traversable: ✅

| Start | Kind | End |
| - | - | - |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | GH\_CanAccessSecret | [GH\_RepoSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_reposecret.md) |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | GH\_CanAccessSecret | [GH\_OrgSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgsecret.md) |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | GH\_CanAccessSecret | [GH\_EnvironmentSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environmentsecret.md) |

```mermaid theme={null}
flowchart LR
    GH_EnvironmentSecret["GH_EnvironmentSecret"]
    GH_OrgSecret["GH_OrgSecret"]
    GH_RepoSecret["GH_RepoSecret"]
    GH_WorkflowJob["GH_WorkflowJob"]
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_EnvironmentSecret
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_OrgSecret
    GH_WorkflowJob -- GH_CanAccessSecret --> GH_RepoSecret
```

## General Information

The traversable GH\_CanAccessSecret edge represents that a GitHub Actions workflow job execution context can access a statically referenced secret.

This edge is derived from the existing non-traversable [GH\_UsesSecret](https://bloodhound.specterops.io/opengraph/extensions/github/edges/gh_usessecret.md) relationships on the job's contained steps and from job-level `env` declarations. It is intended for attack-path analysis from a compromised job execution context to the secrets that context can read.

The collector only emits this edge when one of the workflow job's modeled steps or the job's `env` block statically references the secret. The existence of a secret in the repository, organization, or environment scope alone is not enough. For this initial implementation, secrets passed through `jobs.<job_id>.secrets` to reusable workflows are retained as structural references but are not projected as runtime access for the caller job.

## Edge Schema

| Source | Destination | Traversable |
| - | - | - |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | [GH\_EnvironmentSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_environmentsecret.md) | `true` |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | [GH\_OrgSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_orgsecret.md) | `true` |
| [GH\_WorkflowJob](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_workflowjob.md) | [GH\_RepoSecret](https://bloodhound.specterops.io/opengraph/extensions/github/nodes/gh_reposecret.md) | `true` |

## Diagram

```mermaid theme={null}
graph LR
    n0["GH_WorkflowJob"]
    n1["GH_EnvironmentSecret"]
    n2["GH_OrgSecret"]
    n3["GH_RepoSecret"]
    n0 -->|GH_CanAccessSecret| n1
    n0 -->|GH_CanAccessSecret| n2
    n0 -->|GH_CanAccessSecret| n3
```