One probably has to assume at least some level of control of any system where there's access to secrets where they're necessary for production processes. But i

One probably has to assume at least some level of control of any system where there's access to secrets where they're necessary for production processes. But if you aren't confident of it, then at least that token only has access to a repository, and can't be exfiltrated to let somebody log in and really mess with your user account or your organization. (All that said: I'd recommend a single-use, minimally privileged SSH key over an access token, just because that workflow's what you should be using on a desktop too.)