I'm not sure about this line too. Doesn't this mean if I get your `apiKey` then I now have access to your account? Which then means I can get your github auth token, to generate anything I like on your github account...

Feels like this should be limited to only doing API requests - and maybe needs a little more work (in the bin handlers). I *think* we could push this live now, but not give out any keys, but it would need to be quickly closed as an issue if it does indeed mean that it's a security concern.

@phuu I wouldn't mind your input on this section too.