`GITHUB_ACCESS_TOKEN` must have sufficient permissions to wreak some havoc, which is why we didn't commit it. Might be worth exploring separating _super secret_ dotenv stuff from not-so secret dotenv stuff, though.