critical
github-fine-grained-token· GitHubGitHub fine-grained token
Repository access under the token’s explicitly granted permissions.
How it is detected
Matches the `github_pat_` prefix. Scoped to explicitly granted repositories and permissions, which narrows the blast radius without making it safe.
If you find one
- 1Revoke the token in Settings → Developer settings → Personal access tokens.
- 2Check the account’s security log for pushes, clones and workflow runs you did not make.
- 3Re-issue as a fine-grained token scoped to the one repository that needs it.
Where it turns up
Most often in client bundles built by AI coding tools.