ghp_… (also github_pat_…)
Exposed GitHub Personal Access Token? Here's how to detect and rotate it
A leaked GitHub PAT (ghp_… / github_pat_…) can push malicious code and read private repos. Scan free with Trust, then delete it in Developer settings.
A GitHub Personal Access Token (classic ghp_ or fine-grained github_pat_) authenticates to GitHub as YOU. Depending on its scopes it can read and write your private repositories, push code, and act on your account via the API. A leaked token is a direct path into your source and CI.
What an attacker can do with a leaked GitHub Personal Access Token
- Clones and reads all private repos the token's scopes allow — source, secrets, configs.
- Pushes malicious commits or CI changes to backdoor your software supply chain.
- Reads or writes GitHub Actions secrets and workflows the token can reach.
- Acts on your account — creating repos, deploy keys, or deleting branches/releases.
How GitHub Personal Access Tokens get exposed
- Committed to a public repo or gist — GitHub auto-revokes tokens it detects pushed publicly.
- Hardcoded in a script, Dockerfile, or CI config that got shared.
- Stored in plaintext in a dotfile, .netrc, or a git remote URL that leaked.
- Captured in build logs, a screenshot, or a pasted snippet.
Scan your repo and live site for exposed GitHub Personal Access Tokens — free
Trust checks your code, git history, and shipped JavaScript. No signup, results in about a minute.
Run a free scan →How to rotate a leaked GitHub Personal Access Token
- On GitHub: profile picture → Settings → Developer settings.
- Open Tokens (classic) for ghp_ tokens, or Fine-grained tokens for github_pat_ tokens.
- Delete the leaked token (immediate, irreversible) — for classic tokens you can instead Regenerate it.
- Create a new token with the minimum scopes/repos it actually needs and copy it once.
- Update your git remotes, CI secrets, and any tooling with the new token.
- Review your account's Security log and repo activity for anything the attacker did.