Yes this is a problem in Rust-land too. crates.io doesn't support user tokens to be limited to a crate only [1], but gives access to all the crates an user has

Yes this is a problem in Rust-land too. crates.io doesn't support user tokens to be limited to a crate only [1], but gives access to all the crates an user has access to. So if the token leaks, attackers have access to all your crates. For the cpal crate we worked around the issue by creating a new github user that has only access to the cpal crate (and maybe in the future a few other crates in the same org) but nothing more [2]. This solution isn't really good tho. [1]: https://github.com/rust-lang/crates.io/issues/849 https://github.com/rust-lang/crates.io/issues/849 [2]: https://github.com/RustAudio/cpal/pull/337 https://github.com/RustAudio/cpal/pull/337