Wondering when they will start with implementing proper access controls on their API's. At the moment, a personal access token does have scopes, but it is quite limited:

- Repo access is all or nothing. A read-only token is not possible, an 'issues-only' token is not possible.

- Personal access tokens are not scoped to repositories or organizations. So your personal toy project token also allows access to your super-sensitive employer's repository. On top of that, your employer is unable to prevent this, unless you start using Github Enterprise _and_ an SSH CA, which is far from trivial.

It's nice that they drop username/password access, but as long as personal access tokens have such broad permissions, it does not really add any value (you should have been using 2FA anyway).