#GitHub setup

#Create a Fine-grained PAT

1. GitHub → Settings → Developer settings → Personal access tokens → Fine-grained tokens
2. New token
3. Repository access: Only select repositories, pick the comment repository only
4. Repository permissions → Contents: Read and write
5. Copy the token immediately

#Why a single repository

The PAT scope is the blast radius. Limiting it to one repository means a leak lets an attacker write junk files there, nothing more.

#Rotation

• PAT: revoke the old token, update GITHUB_TOKEN, redeploy
• COMMENTS_SECRET: every unused review link stops working; stored ciphertext carries a fingerprint so an old key can stay around for decryption

#Permission check

After deploy, git.readable in /api/health proves read access. Write access is only proven when you approve a comment.

Common 403 causes:

• The PAT has no access to that repository
• Contents permission is Read instead of Read and write
• owner/repo has a typo or wrong case