Is it safe to just give this an OAuth token for private repo access?