EngineeringScoreExposure Medium
Revoke the exposed GitHub token
A GitHub token inherits whatever scopes it was issued with, from read-only access to a single repository up to full account or organization control. A token shipped to the browser is exposed to anyone who loads the page, and its blast radius (private source code, CI secrets, the ability to push commits) depends entirely on what it was scoped to do.
Why it matters
A GitHub token inherits its scope's permissions, which can include reading private source code, pushing commits, or reading other secrets stored in the repository or its CI pipeline.
How to fix
- 1 Revoke the token in GitHub (Settings > Developer settings, or the owning GitHub App/OAuth app). This is the only step that stops it from working.
- 2 Move any use of the token to a server-side environment or CI secret store; never ship a GitHub token to the browser.
- 3 Purge it from git history so it is not recoverable from a prior commit.
- 4 Redeploy, confirm the new build no longer ships the token, and review recent repository activity for anything unexpected.
Common mistakes
- Revoking the token but not checking whether the same value was also stored as a separate CI/CD secret, leaving a second live copy unrevoked.
- Issuing a broadly scoped token for a narrow task (e.g. full repo access for something that only needed to read one file), which increases the damage if it leaks.
- Removing the token from the current build without purging it from git history, leaving it retrievable from any prior commit.
How to verify
- 1 Re-run the scan and confirm the GitHub token finding is gone.
- 2 Grep the built/deployed JavaScript bundle for the token prefix (ghp_, gho_, ghu_, ghs_, or ghr_) to confirm none remain.
- 3 Confirm the revoked token now fails authentication rather than assuming revocation took effect.
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.