From: M Hickford <mirth.hickford@gmail.com>
Date: Sat, 18 Jan 2025 20:33:04 GMT
Subject: Re: transfer.credentialsInUrl should warn about personal access tokens in user field #leftoverbits
Message-ID: <77741bb3-be37-4e63-9bf8-0cbeac50ae24@gmail.com>
In-Reply-To: <Z4GZ0oiZCC2Wl3bN@tapette.crustytoothpaste.net>

On 2025-01-10 22:06, brian m. carlson wrote:
> No, this is Basic auth.  It's just that GitHub will look at either the
> username or password field for the token.

Thanks Brian and Junio for the discussion. I understand your aversion to 
introducing GitHub-specific PAT detection logic.

The better solution would be for GitHub to stop accepting PAT in the 
username field. Hopefully that will happen one day. It's undocumented,
so its usage ought to diminish.

To speed that along, I've edited the offending StackOverflow answer 
https://stackoverflow.com/a/70320541/284795