Opus finding
ANTFLEET_OPS_GH_TOKEN is shared with manual `gh` work — broad-scope PAT used by automated cron path
mediumsecuritymedium
- apps/web/lib/outgoing-prs.ts:18-24
- apps/web/lib/outgoing-prs.ts:136-144
The comment explicitly states the token is shared between automated cron polling and manual `gh` operator work. PATs typically have broad org/repo scope; using the same token for both raises blast radius if it leaks (e.g. via logs). For polling public PR state, only `public_repo` (read-only) scope is needed; using a higher-scoped human token violates least-privilege.
Recommendation
Mint a dedicated fine-grained PAT or App installation token scoped to read-only PR access on the specific upstream repos, separate from the operator's manual-work PAT. Or use unauthenticated public API calls (lower rate limit but still feasible at one-hour cadence per row).