如何从 github 提交个人访问令牌

Question

I made a test app which uses github's graphQL api. For using this api the personal access token has been placed inside the code. Now whenever I commit the code with token, I get email from github which has title: "Action needed: GitHub access token found in commit, any app using this secret may be affected".

How should I commit the personal access token in my code? Or should I never commit such tokens in the code? If not, then where should I keep these tokes? So that I can access these tokens whenever the grapQL api is called.

PS: I am creating this app using vue3 only

Answer 1

Never publish them on any open platform, There are many safe options. eg store tokens in a file that is ignored by git (but then you'll have to make sure you manually put this file in every clone of your repository). Or you can set up an environment variable in your operating system with your token.

For your current situation, you better generate a new token and never share it. Or a less secure option would be to use some external tool that overrides git history, so that you can purge the file that contains the token from the older commits (but the Inte.net never forgets, it doesn't guarantee that noone has stolen your token already). An article about how to remove something leaked to GitHub