Like, how am I supposed to run an audit of tokens?

Wait. How are **GitHub** running an audit of tokens?