The token needs Projects: read & write (an account permission) and Issues: read & write on the repos it should reach — a classic PAT with project + repo covers both, and only that kind can delete an issue outright. It is stored in this browser's localStorage and sent only to api.github.com. This page is public; the token in your own browser is the only thing that makes it yours.
ColoursA colour here is the same colour everywhere it means the same thing — chip, card rail, column head. Kept in this browser, beside the token; ↺ puts one back.