Use a fine-grained personal access token scoped to just this one repo, with "Contents: read and write" permission only. The token is stored solely in this browser's local storage and is sent only to api.github.com directly from this page.