The token needs access to this one repo only, with Contents: read & write. It is stored in this browser's localStorage and sent only to api.github.com. Every change you make here becomes a commit to queue.json.