GitHub token pattern appears in public content
ShipReady found a non-placeholder string matching a supported GitHub token pattern in scanned page or script content.
Why it matters
A real GitHub token belongs in server-side secret storage, not in a client asset that any visitor can inspect.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for supported ghp_, gho_, ghu_, ghs_, ghr_, and github_pat_ token formats, with a placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches one of the supported GitHub token patterns.
What the evidence shows
The scanner observed a string matching a supported GitHub token format and retains only a redacted prefix in the report.
Limits of this check
ShipReady does not authenticate to GitHub, validate the token, inspect scopes, access repositories or workflows, or identify the token owner. A format match does not prove the token is active, usable, or able to access a repository.
How to fix it
Trace the value to its source
Identify the source file, environment substitution, or build input that placed the value into public content.
Remove confirmed credentials from client assets
Keep real GitHub tokens in server-only secret storage and prevent them from being inlined into browser bundles.
Review a confirmed token
If investigation confirms a real token, use the owning account's controls to review and replace it.
How to verify the change
Inspect deployed content
Search deployed HTML and JavaScript after the release.
Expected: No unintended string matching a supported GitHub token pattern remains in public assets.