What is the security risk of using a Personal Access Token with 'repo' scope for GitHub API access?
Select an answer to reveal the explanation.
Short Explanation and Infographic
The 'repo' scope is a skeleton key — it opens every door the token owner has access to. One leaked PAT with repo scope means an attacker gets read/write to all private repos the user can touch. That's exactly why fine-grained PATs exist.
Full explanation below image
Full Explanation
Classic Personal Access Tokens with the 'repo' scope grant read and write access to ALL repositories the token owner has access to, including private repositories across all organizations they're members of. This broad access means: (1) A leaked PAT with repo scope is catastrophic — attackers gain access to all code, can push malicious commits, and can potentially read secrets in code. (2) Even if the token is intended for one repository, it provides access to hundreds or thousands more. (3) There's no repository-level restriction for classic PATs. The 'repo' scope actually encompasses several sub-scopes: repo:status, repo_deployment, public_repo, repo:invite, security_events. This risk is why GitHub created fine-grained PATs with per-repository scoping.