this is weird: I needed to clone a private git repo of a customer (after they made my github account an org member).

I created a personal access token and then did

git clone https://username:[email protected]

except I mistyped my username and it still worked.

Do they only check the token?