// the find
cmliu/CF-Workers-Raw
这个项目允许你通过Cloudflare Workers安全地访问GitHub私有仓库中的原始文件，无需直接暴露你的GitHub令牌。
A single-file Cloudflare Worker that sits in front of GitHub's raw content host and injects a server-side PAT, so you can share a URL to a file in a private repo without handing out the actual GitHub token. Aimed at people who want to serve a private config/script file publicly (e.g. install scripts, dotfiles) without exposing their PAT in the URL.
Dead simple to deploy — one _worker.js and a wrangler.toml, no build step. TOKEN_PATH lets one deployment front multiple repos/branches with separate per-path shared secrets instead of one global password. It does correctly separate the client-facing secret from the real GH_TOKEN, so a leaked client URL doesn't directly leak your GitHub PAT.
The 'auth' is a plaintext string compared via a query param — it ends up in browser history, Cloudflare/GitHub access logs, and Referer headers, with no timing-safe comparison or rate limiting on brute-forcing short tokens like TOKEN_PATH values. There's no caching layer, so every hit round-trips to GitHub and burns the single GH_TOKEN's 5000/hr rate limit with no visible handling of 403/429 — a handful of bots hitting a shared URL can lock out the real user. The GH_NAME/GH_REPO/GH_BRANCH path-hiding feature silently stops applying the moment someone uses a full raw.githubusercontent.com URL instead, so the two access modes behave inconsistently and it's easy to think you're hidden when you're not. No tests, no CI, everything in one undocumented file — fine for a weekend script, but you're trusting unreviewed auth logic before putting a real PAT behind it.