Well yes, the token can only be used for this file, and if people want to go ahead and copy the code, no problem. The reason for the repo to be private is to avoid giving an incentive to people to fork it, but I don't mind that people who really want to access the code of this file do it (they can when they load it in their browser anyway).