Private Github API access token in FoundationPress?

[Aetles]

In https://github.com/olefredrik/FoundationPress/blob/master/src/assets/js/lib/demosite.js there is an access token committed on line 5.

Maybe I'm misreading this code, but isn't that a private Github API access token? Is that supposed to be part of FoundationPress?

[colin-marshall]

@Aetles good spot. While on this topic, I have wondered if it would be possible for @olefredrik to somehow keep the demo site in his own repo and while having it removed from the main GitHub repo. Maybe he could just keep the demo site in a separate local branch and merge in updates from master?

[olefredrik]

I realize that it's bad practice to push a Github API Access token to a public repo. And it should never have been pushed to the master branch in the first place. That said, Github has a built-in security mechanism that automatically revokes the token, when this happens.

Thanks for the heads up 👍

[Aetles]

That said, Github has a built-in security mechanism that automatically revokes the token, when this happens.

Didn't know that, good!