alt Hacker NewsPAT are vulnerable, once stolen they can be used from anywhere until their (usually) long term expiry.
Better use short lived tokens with auto refresh. For example OAuth tokens. They can be used for the same use cases like PAT, but they expire after a max of 2 hours.
Which oauth tokens are you talking about? Because GitHub’s created by oauth or gh apps have a lifetime of either 8h or forever.