According to this link there is a scope for the OAuth tokens that seems to provide access to the GitHub public resources only.
(no scope): Grants read-only access to public information (includes public user profile info, public repository info, and gists)
Is it still insecure to include this personal access token in my JavaScript client side code?