A classic personal access token with the repo scope can read and write every repository the account can access. A fine-grained token names the repositories it applies to and the permissions it grants within them.

For filing issues, the correct configuration is a single repository with the Issues repository permission set to Read and write. That token cannot read your source, cannot push, and cannot touch any other repository.

Fine-grained tokens also expire by policy, which turns credential rotation from an intention into a scheduled event.

Why it matters

A third-party tool holding a credential is a risk you can size. A token scoped to one permission on one repository is a small one.