over-privileged automated workflow tokens are a high-risk issue because attackers can use a compromised token with write access to push malicious code into projects. Elevated GitHub tokens can ...