At that point you've done something much more invasive and detectable than exporting a .env file and you've walked away with a very short lived token. There's a

At that point you've done something much more invasive and detectable than exporting a .env file and you've walked away with a very short lived token. There's always "something more an attacker can do", I'll stand by the view that requiring further authentication to perform interactive actions and pushes is worthwhile.