It looks like every project by default has a standing token with read privileges. It never expires and its not opt-in. Unless I’m missing something, that seems

It looks like every project by default has a standing token with read privileges. It never expires and its not opt-in. Unless I’m missing something, that seems ridiculous.