Fine grained PAT Expired After Pushing a File Containing the PAT to a Public Repo

[AkinduID]

Hi, I created a fine-grained Personal Access Token (PAT) for testing, set to expire in a year. However, it expired unexpectedly.

I tried pushing a branch that contained a file with the PAT to a public repository. After bypassing push protection to expose the token, I was able to push successfully. Could this have caused the token to expire? Any help would be appreciated.

[Rochdi7]

Hey @AkinduID,

Yeah, that’s exactly why your PAT got revoked. GitHub has automatic secret scanning, and if it detects a token in a public repo, it immediately disables it for security reasons. Even if you bypass push protection, GitHub still invalidates the token.

To avoid this in the future:

Never push secrets to a repo (even private ones).
Use environment variables or secret management tools.
Regenerate your PAT and keep it somewhere safe.
Check out GitHub’s token security docs for more info.

[ghostinhershell]

Hi @AkinduID 👋🏾, @Rochdi7's response here is the answer to your question. Can you please mark their response as the answer? When you mark a question as an answer, GitHub will highlight the comment and replies to the comment to help visitors quickly find the answer.