Leaked GitHub PAT — repo exfiltration and supply-chain risk

GitHub PATs grant repo-level access to the issuing account. A leaked classic PAT with `repo` scope gives an attacker read and write on every private repo the user can access. Fine-grained PATs are scoped but still dangerous.