Security & tokens

Pro feature. OAuth is the recommended connect method. Treat GitHub tokens like production credentials.

  • Connect GitHub via OAuth Device Flow on the GitHub Sync screen — PAT is optional fallback
  • Tokens are stored encrypted in WordPress options — still restrict admin access
  • Prefer fine-grained tokens with read/write on one repository
  • Use private repositories for client code
  • Rotate tokens if a team member leaves or a token is exposed
Warning
  • Anyone with manage_options and access to Grafucci Code settings can use a stored token.
GitHub Sync connected workspace
Prefer OAuth Device Flow — connected Sync overview after authorize