It's in a public repository, and people need to actually get a hold of a token. Brute force is not likely, therefore it is as secure as your token. I'll switch this to oauth or some token authentication system.