> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-bp-2735-release-notes.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# GH_HasSecret

> Repository or environment has access to this secret

<img noZoom src="https://mintcdn.com/specterops-bp-2735-release-notes/2djt2Sp9UeFPjBFr/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=2djt2Sp9UeFPjBFr&q=85&s=a791748158fde5ff3b3b82b51497ab39" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Edge Schema

* Source: [GH\_Repository](/opengraph/extensions/github/nodes/gh_repository), [GH\_Environment](/opengraph/extensions/github/nodes/gh_environment)
* Destination: [GH\_OrgSecret](/opengraph/extensions/github/nodes/gh_orgsecret), [GH\_RepoSecret](/opengraph/extensions/github/nodes/gh_reposecret), [GH\_EnvironmentSecret](/opengraph/extensions/github/nodes/gh_environmentsecret)
* Traversable: ✅

## General Information

The traversable GH\_HasSecret edge represents the relationship between a repository or environment and the secrets accessible within that context. This edge shows which secrets are available in which scopes. Repositories can have access to both organization-level secrets (scoped to selected repositories) and repository-level secrets, while environments contain their own environment-scoped secrets. This edge is traversable because any principal that can push code to a repository (via [GH\_CanWriteBranch](/opengraph/extensions/github/edges/gh_canwritebranch) or [GH\_CanCreateBranch](/opengraph/extensions/github/edges/gh_cancreatebranch)) can write a workflow that exfiltrates the secret values at runtime, making this a meaningful link in attack path analysis.

```mermaid theme={null}
graph LR
    node1("GH_Repository GitHound")
    node2("GH_OrgSecret NPM_TOKEN")
    node3("GH_RepoSecret DEPLOY_KEY")
    node4("GH_Environment production")
    node5("GH_EnvironmentSecret AWS_SECRET_KEY")
    node1 -- GH_HasSecret --> node2
    node1 -- GH_HasSecret --> node3
    node4 -- GH_HasSecret --> node5
```