# personal access token Published articles for personal access token. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs DevFeed: [A Threat Hunter's Guide to Detecting Malicious Activity in GitHub Audit Logs]() Original publisher: [Read original article]() Author: Julie Agnes Sparks, Juvenal Araujo Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [GitHub](), [Threat Hunting & Intel](), [Security](), [Logging](), [Authentication](), [personal access token]() Tags: [authentication](), [github](), [logging](), [oauth](), [personal-access-token](), [secrets](), [security](), [security-research]() ### AI overview This article examines threats targeting GitHub organizations, including compromised accounts, personal access tokens, OAuth tokens, leaked secrets, phishing, and malicious extensions or OAuth apps. It describes GitHub audit-log queries and behaviors that can help detect account compromise, reconnaissance, and source-code exfiltration. ### Source excerpt In this post, we walk through different threats to GitHub and how to detect them. ## AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026) DevFeed: [AsyncAPI supply chain compromise: npm packages backdoored via GitHub Actions "pwn request" (July 2026)]() Original publisher: [Read original article]() Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub Actions](), [npm packages](), [AsyncAPI Specification](), [Malware](), [GitHub](), [Remote Access Trojan](), [passwords](), [ssh](), [Cloud](), [Cryptocurrency]() Tags: [asyncapi-supply-chain-attack](), [chainguard-asyncapi](), [chainguard-libraries](), [ci](), [cloud](), [cryptocurrency](), [github](), [github-actions](), [github-actions-pwn-request](), [malicious-packages](), [malware](), [miasma](), [npm](), [npm-packages](), [passwords](), [personal-access-token](), [provenance](), [pull-requests](), [remote-access-trojan](), [ssh](), [supply-chain](), [tokens]() ### AI overview The article analyzes a July 14, 2026 supply-chain compromise in which an attacker stole a privileged GitHub personal access token through a misconfigured GitHub Actions workflow and used it to publish five backdoored versions across four AsyncAPI npm packages. The malware activates when a library is loaded by a build or CI job and steals browser passwords, SSH keys, npm and GitHub tokens, cloud credentials, and cryptocurrency wallets while maintaining command-and-control access. It also explains why Chainguard customers were protected and recommends treating affected environments as compromised and rotating credentials. ### Source excerpt A supply chain attack compromised AsyncAPI npm packages via GitHub Actions. See how Chainguard blocked the malicious releases by design. ## Harness MCP Server Now Connects Google Antigravity IDE DevFeed: [Harness MCP Server Now Connects Google Antigravity IDE]() Original publisher: [Read original article]() Author: Rohan Gupta Chinmay Gaikwad Published: 2026-06-22T00:00:00Z Content type: release Language: en Sources: [Harness Blog]() Topics: [MCP Server](), [Model Context Protocol (MCP)](), [ide](), [Artificial Intelligence](), [Google]() Tags: [agents](), [ai](), [ai-agents](), [antigravity](), [google-antigravity](), [harness](), [ide](), [integration](), [mcp](), [mcp-server](), [personal-access-token]() ### AI overview Harness announces that its MCP Server connects directly to the Google Antigravity IDE, allowing AI agents to inspect pipelines, debug deployments, trigger approved runs, and use real-time delivery context. The article also describes setup with a Harness Personal Access Token and Antigravity's Customizations panel. ### Source excerpt Connect Harness MCP Server inside Google Antigravity to let AI agents inspect pipelines, debug deployments, trigger approved runs, and act on real-time delivery | Blog ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## Replacing Long-Lived GitHub Personal Access Tokens with Short-Lived Credentials Using Octo STS DevFeed: [Replacing Long-Lived GitHub Personal Access Tokens with Short-Lived Credentials Using Octo STS]() Original publisher: [Read original article]() Published: 2024-04-11T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [GitHub](), [Security](), [octo sts](), [GitHub Actions](), [Authorization]() Tags: [ephemerality](), [github](), [github-actions](), [github-credentials](), [github-pat](), [github-personal-access-token](), [least-privilege](), [minimalism](), [octo-sts](), [personal-access-token](), [principle-of-ephemerality](), [pull-requests](), [rotation](), [secrets](), [security](), [security-token-service]() ### AI overview This article explains how Chainguard replaced long-lived GitHub Personal Access Tokens and other credentials with short-lived credentials across several GitHub organizations. It introduces Octo STS as a Security Token Service for GitHub credentials and describes the automation use cases that built-in GitHub Actions tokens could not support. ### Source excerpt Ditch GitHub PATs for better security. Learn how to replace long-lived tokens and reduce your risk of leaked credentials. ## Using the GitHub GraphQL API with Apollo Studio Explorer DevFeed: [Using the GitHub GraphQL API with Apollo Studio Explorer]() Original publisher: [Read original article]() Author: Ceora Ford Published: 2022-03-03T15:39:31Z Content type: tutorial Language: en Sources: [Apollo Blog]() Topics: [GitHub API](), [GraphQL](), [GitHub]() Tags: [github](), [graphql](), [guide](), [how-to](), [personal-access-token](), [workflows]() ### AI overview This tutorial explains how to use Apollo Studio Explorer with the GitHub GraphQL API. It covers the API's capabilities, setup and personal access token authentication, and guides readers through building three useful queries. ### Source excerpt GraphQL APIs provide data that can be extremely useful to you, your team, or your project. Being able to test and run queries for GraphQL APIs can help you build well-designed queries for your application. Apollo Studio Explorer helps you do this. This is especially useful when you're working with large APIs that contain lots of types and fields. The GitHub GraphQL API is one such API. So let's test out Apollo Studio Explorer by building queries for the GitHub API. ## Multi-platform Docker images with GoReleaser, Podman and GitHub Actions DevFeed: [Multi-platform Docker images with GoReleaser, Podman and GitHub Actions]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2021-08-01T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [Docker](), [podman](), [GitHub Actions](), [Docker Hub](), [GitHub Container Registry](), [personal access token]() Tags: [distribution](), [docker](), [docker-images](), [github-actions](), [github-container-registry](), [manifest](), [personal-access-token](), [podman]() ### AI overview A tutorial showing how to build and publish multi-platform container images with GoReleaser, Podman, and GitHub Actions. It explains rootless, daemonless Podman usage, multi-platform builds and manifests, GitHub Container Registry authentication with a personal access token, and release automation. ### Source excerpt A few months ago, I published a post on Multi-platform Docker images with GoReleaser and GitHub Actions. Today's post has the same idea, but using Podman instead of Docker. ## Cards API DevFeed: [Cards API]() Original publisher: [Read original article]() Author: Leher Pathak Published: 2021-06-16T19:00:00Z Content type: release Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [API](), [OAuth](), [personal access token](), [Documentation]() Tags: [api](), [api-documentation](), [apis](), [deprecated](), [oauth](), [payments](), [personal-access-token](), [release](), [rest](), [slack](), [terminal](), [webhooks]() ### AI overview Square's Cards API lets developers store, retrieve, and manage customers' credit and debit cards on file for recurring payments and marketplace applications. It supports webhooks, automatic updates, and replaces deprecated Customers API card endpoints. ### Source excerpt Manage shared cards on file for recurring payments ## Using GitHub Workflow with Maven dependencices from a private GitHub Package Registry DevFeed: [Using GitHub Workflow with Maven dependencices from a private GitHub Package Registry]() Original publisher: [Read original article]() Author: Schakko Published: 2020-12-19T11:08:46Z Content type: tutorial Language: en Sources: [Schakko]() Topics: [GitHub](), [Maven](), [GitHub Actions](), [CI/CD]() Tags: [artifactory](), [automated](), [build](), [ci-cd](), [dependencies](), [deployment](), [github](), [github-actions](), [library](), [maven](), [personal-access-token](), [project](), [registry](), [repository](), [sonatype](), [workflow]() ### AI overview A tutorial on publishing Maven artifacts to a private GitHub Package Registry using GitHub Actions. It explains the Maven distribution-management setup, Personal Access Token requirements, local testing, and workflow configuration for automated deployment. ### Source excerpt GitHhub Package Repository provides an easy way to share dependencies like Maven artifacts between GitHub projects. Publishing of new artifacts into GitHub Package Repository can be automated with GitHub Actions. In May 2019 GitHub introduced the GitHub Package Registry: an alternative to some traditional package registries like Sonatype Nexus. During [...] The post Using GitHub Workflow with Maven dependencices from a private GitHub Package Registry appeared first on schakko.de. ## Adding Staticman Comments DevFeed: [Adding Staticman Comments]() Original publisher: [Read original article]() Author: Travis Downs (travis.downs@gmail.com) Published: 2020-02-05T00:00:00Z Content type: tutorial Language: en Sources: [Performance Matters]() Topics: [GitHub](), [GitHub Pages](), [Bot](), [Pull Request](), [Heroku](), [personal access token](), [hosting](), [repo]() Tags: [blog](), [file](), [github](), [github-pages](), [guide](), [heroku](), [hosting](), [meta](), [personal-access-token](), [pull-request](), [static-site](), [staticman]() ### AI overview A tutorial explaining how to add Staticman comments to a static blog. It covers the submission flow, deploying the API bridge on Heroku, using GitHub pull requests to store comments, and republishing through GitHub Pages. ### Source excerpt Adding static comments to a static blog using staticman. Static. ## Text for your sales reports using Twilio Functions and Square DevFeed: [Text for your sales reports using Twilio Functions and Square]() Original publisher: [Read original article]() Author: Tristan Sokol Published: 2017-06-09T19:54:35Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [Messaging](), [Serverless](), [Transactions](), [personal access token](), [Query (disambiguation)](), [Code]() Tags: [apis](), [app](), [code](), [communications](), [developer](), [messaging](), [personal-access-token](), [reports](), [serverless](), [transactions]() ### AI overview This tutorial shows how to use Twilio Functions and Square APIs to build an SMS workflow that returns daily sales totals. It covers configuring a Twilio phone number and function, connecting to Square with a personal access token, querying the List Transactions endpoint, summing the results, and returning the total by text message. ### Source excerpt Square's Developer team just got back from SIGNAL 2017, where we made a mash-up of the Twilio and Square APIs. ## Webhooks in the Square Connect API DevFeed: [Webhooks in the Square Connect API]() Original publisher: [Read original article]() Author: Square Engineering Published: 2014-12-16T17:08:00Z Content type: tutorial Language: en Sources: [Square Corner Blog RSS Feed]() Topics: [API](), [real-time](), [servers](), [HTTP](), [JSON]() Tags: [api](), [apis](), [curl](), [http](), [json](), [notifications](), [payment](), [personal-access-token](), [real-time](), [server](), [square](), [webhooks]() ### AI overview A tutorial showing how to use Square Connect API webhooks to receive real-time notifications when payments or refunds are processed. It covers configuring a server, registering an application, enabling webhooks, subscribing to notifications, and testing with a payment. ### Source excerpt Setting up real-time payment notifications