Use a GitHub personal access token safely

A GitHub personal access token (PAT) is a secret credential. Create one only when the operation needs it, prefer a fine-grained token with a single owner/repository and minimum permissions, and set an expiry when possible. GitHub's token settings and permission names change, so use the current GitHub documentation.

For Git over HTTPS, let Git's credential manager store the token securely when prompted for a password. Do not put it in a remote URL, shell history, source file, or CI log. SSH keys or GitHub App/OIDC credentials may be a better fit for automation.

If a token may have leaked, revoke it immediately, inspect recent activity, and replace dependent credentials. A PAT grants only the permissions selected, but it can still expose repositories or mutate data within that scope. Test with a low-risk read operation and avoid using a personal token for a shared production integration when an organization-managed identity is available.

Sources

• Git documentation
• GitHub Docs