KeyDrift
Free scan
criticalgithub-token· GitHub

GitHub token

Repository access under the token’s scopes — for a classic PAT, usually every private repo the user can see.

How it is detected

Matches the `ghp_`, `gho_`, `ghu_`, `ghs_` and `ghr_` prefixes. A classic personal access token usually carries every private repository the user can see.

If you find one

  1. 1Revoke the token in Settings → Developer settings → Personal access tokens.
  2. 2Check the account’s security log for pushes, clones and workflow runs you did not make.
  3. 3Re-issue as a fine-grained token scoped to the one repository that needs it.
https://github.com/settings/tokens →

Where it turns up

Most often in client bundles built by AI coding tools.

Fix it in your stack