Your token is used only to call the GitHub API directly from your browser. It is never sent to or stored on this server. Needs repo + read:user scopes for private-repo data.