Secret scope is the boundary that defines where a stored credential can be used. In systems like GitHub Actions, a secret may be scoped to a repository, an organization, or an environment. That scope controls which workflows, branches, or deployment stages can read the value at runtime.
This matters because the same secret can be safe in one context and dangerous in another. If a workflow is compromised, weak secret scope can let attacker-controlled automation reach tokens, API keys, or cloud credentials that were meant only for release jobs or production deploys. Defenders reduce risk by narrowing scope, using least-privilege permissions, separating build and deploy secrets, and preferring short-lived credentials. In attacks, changing or injecting a workflow is often a way to test whether a secret is exposed at the wrong scope.