Fix Leaked GitHub Personal Access Tokens in Vibe-Coded Apps

Quick answer

Leaked GitHub Personal Access Tokens (PATs) in vibe-coded apps expose your repositories, CI/CD pipelines, and cloud infrastructure to unauthorized access. To fix them immediately: revoke the leaked token on GitHub, rotate it, and scan your entire codebase with a secret scanner to ensure no other tokens are exposed.

What to check first

Before diving into fixes, run through this checklist to assess the damage and prevent further leaks:

Step-by-step fix

1. Revoke and rotate the token

Go to GitHub Settings > Developer settings > Personal access tokens. Find the leaked token, click "Delete", then generate a new token with the minimum necessary scopes. Store it securely as an environment variable.

2. Remove the token from your codebase

Delete the token from all files. Use git filter-branch or BFG Repo-Cleaner to purge it from Git history:

# Install BFG: brew install bfg
# Create a text file with the token to remove
echo "YOUR_LEAKED_TOKEN" > tokens.txt
# Run BFG to scrub history
bfg --replace-text tokens.txt .
# Force push the clean history
git push --force

3. Add a .gitignore entry for secret files

Ensure files like .env, .env.local, or secrets.json are never committed:

# .gitignore
.env
.env.local
*.pem
secrets.json

4. Set up automated scanning

Integrate a pre-commit hook to catch secrets before they're committed. Create .git/hooks/pre-commit:

#!/bin/sh
# Check for common secret patterns
if git diff --cached | grep -qiE '(ghp_|gho_|github_pat_)'; then
  echo "ERROR: GitHub token detected in staged changes. Commit blocked."
  exit 1
fi

Make it executable:

chmod +x .git/hooks/pre-commit

5. Use environment variables everywhere

Replace hardcoded tokens with environment variables in your code:

// Bad
const GITHUB_TOKEN = 'ghp_1234567890abcdef';

// Good
const GITHUB_TOKEN = process.env.GITHUB_TOKEN;

For deployment, set GITHUB_TOKEN in Vercel or Netlify environment variables. You can also use OverMCP's continuous security monitoring to get alerted when new secrets appear in your repo.

Common mistakes

Vibe-coded apps often make these specific errors with GitHub tokens:

FAQ

How do I know if my GitHub PAT has been leaked?

Check your GitHub audit log for unusual access patterns, or run a secret scanner on your repository. OverMCP's free AI app security scanner can automatically detect exposed GitHub tokens in your codebase.

Can I delete Git history to remove a leaked token?

Yes, but it's risky — force pushing rewrites history for all collaborators. Use git filter-branch or BFG Repo-Cleaner carefully. Always revoke the token first.

What's the safest way to use GitHub tokens in a vibe-coded app?

Never hardcode tokens. Use environment variables, set them in your hosting platform's dashboard, and never commit files that contain secrets. For additional protection, use a secret scanning service that monitors your repo continuously.