GitHub auto-disabled my token. Do I still need to do anything?

Yes. GitHub auto-revokes ghp_ and github_pat_ tokens it detects on public repos, but the window between leak and detection can be minutes — long enough for a bot to clone private repos. Audit your security log for unfamiliar activity.

Should I use fine-grained or classic tokens?

Fine-grained. They scope to specific repos and permissions, so a leak is contained. Classic tokens are scoped to your entire account.

Critical: act in the next 60 seconds

GitHub personal access token leaked? Revoke before it gets used

Your GitHub personal access token may be exposed. Here is the fastest possible recovery — three steps, no theory.

Step 01
Go to GitHub → Settings → Developer settings → Personal access tokens → find the leaked token and Delete.
Step 02
Create a fine-grained replacement scoped to the minimum repos and permissions you actually need.
Step 03
Review your security log: github.com/settings/security-log — filter for actions from unfamiliar IPs in the leak window.

Step 01 — Revoke

Kill the leaked credential first

Settings → Developer settings → Personal access tokens → Tokens (classic) or Fine-grained tokens. Click the leaked token → Delete. Confirm. Then "Generate new token (fine-grained)" with a minimum-permission set.

Open GitHub tokens

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

Update your CI and local env

# .env (server side, never committed)
GITHUB_TOKEN=github_pat_...

# Update GitHub Actions / Vercel / Railway env vars too

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan to confirm the token is no longer in your deployed bundle and nothing else is leaking with it.

How this usually leaks

01Committed in a .npmrc or ~/.netrc file accidentally added to git.
02Pasted into a GitHub Actions workflow file as a literal instead of ${{ secrets.GITHUB_TOKEN }}.
03Embedded in a config file deployed to /public/ for client-side gh-pages style "auth".
04Stored in a Postman collection committed to source control.

FAQ

Frequently asked questions

GitHub auto-disabled my token. Do I still need to do anything?: Yes. GitHub auto-revokes ghp_ and github_pat_ tokens it detects on public repos, but the window between leak and detection can be minutes — long enough for a bot to clone private repos. Audit your security log for unfamiliar activity.
Should I use fine-grained or classic tokens?: Fine-grained. They scope to specific repos and permissions, so a leak is contained. Classic tokens are scoped to your entire account.

Deeper dive

Long-term fixes for this leak class

Hardcoded API key in JS

Any secret in your client bundle is public. Here is how to find them, rotate them, and move the calls server-side.

Exposed .env file

An exposed .env file is a critical leak — it contains API keys, database URLs, and secrets. Here is why it happens in vibe-coded apps and how to lock it down.

See what else leaked in the same deploy

Free scan. 70+ checks. Results in 60 seconds.