A single lost access token that had global permissions already had the ability to get everything: GitHub’s API is already very full-featured. The fix here is t

A single lost access token that had global permissions already had the ability to get everything: GitHub’s API is already very full-featured. The fix here is to use their scoping as intended: it should be amazingly rare to need an access token with such broad access.