GitHub adds stage-only scope for npm granular access tokens

Sat, 19 Sep 2026 14:03:42 +0000

Platform/SRE — Skip
CI/CD — Plan: Adopt the new ‘stage only’ permission when minting npm automation tokens to enforce least-privilege publishing; schedule a rotation of existing CI npm tokens to apply the tighter scope and reduce blast radius from a leaked credential.
Leader — Skip

Token-Security on CuraDevOps