CuraDevOps

tag: Token-Security · 1 items

Plan archived GitHub adds stage-only scope for npm granular access tokens
2026-09-19 · GitHub Changelog · source ↗ #npm#supply-chain#token-security
  • Platform/SRE — Skip
  • CI/CD — Plan: Adopt the new ‘stage only’ permission when minting npm automation tokens to enforce least-privilege publishing; schedule a rotation of existing CI npm tokens to apply the tighter scope and reduce blast radius from a leaked credential.
  • Leader — Skip