What a GitHub token looks like

Classic personal access tokens start with ghp_ followed by 36 letters and digits. OAuth tokens use gho_, GitHub App tokens ghs_ and ghu_, refresh tokens ghr_. Fine-grained tokens start with github_pat_ and are much longer.

A fake example, in the right format:

ghp_Fak3T0k3nF0rScrubL0gsD3m0nstrat10n12

ScrubLogs replaces it with <GITHUB_TOKEN_1>.

Why a leak is dangerous

A token acts as you: depending on its scopes it can read private repositories, push code, change workflows and read secrets used by Actions. GitHub automatically revokes tokens it finds in public repositories, but not ones pasted into chats, tickets or other sites.

If yours leaked: rotate it

Redacting a copy doesn’t un-leak the original. If the real value was shared anywhere, replace it:

1. Go to Settings → Developer settings → Personal access tokens and delete the leaked token.
2. Create a replacement with the narrowest scopes and shortest expiry that still work.
3. Check your security log and recent pushes for activity you don’t recognise.
4. Prefer fine-grained tokens limited to specific repositories.