mirror of
https://github.com/Comfy-Org/ComfyUI.git
synced 2026-08-05 18:05:08 +08:00
c7e4ddfb59
An App private key is not scoped: it can mint tokens for every repo its App is installed on, with the App's full entitlement. The owner and repositories inputs are step arguments, not a boundary. cloud-code-bot is entitled to cloud's production release and migration workflows, so storing its key in this public repo would join the two repos' trust boundaries at the weaker one. Use a single-purpose App holding only contents:write on Comfy-Org/cloud instead -- the same minimal scope the outgoing PAT had, without the silent expiry.