unkin-agent
dd26c861fc
Defense in depth for the repo-creation bot: a restricted Gitea account can only see repositories and organisations it is explicitly added to, so a leaked repospawner token cannot enumerate or read the rest of the estate. The repospawner team grant on terraform-git already covers everything the bot does, so nothing it needs is lost.