A github repo has an API token for a website in its code. (maybe the 10 people who starred it, actually thanked for the token lol)

The maintainer was active last time before 1 year and is a college student

Now what?