Bot-security

A bot token is an operational credential. Anyone who obtains it may be able to impersonate the bot, read permitted events or perform administrative actions within the granted scope. Keep secrets outside code Do not place tokens in repositories, screenshots, support posts or container images...