Is this approach really "better" than PAT ?

[ViacheslavKudinov]

Hi,
i'm trying to understand why this is "better" than static PAT when to use App ID and Private key on this Action.

If these credentials are leaked (let say same as PAT/FPAT) anyone still can use it to generate Token to access the repositories (or other resources, depends on scope) where GitHub application is installed.

There is no restriction that App and its private key belongs/can be used only on the GitHub organization where this create-github-app-token runs,
means if i have App ID and Private key of the app from organization "A", i still can generate token by running this Action on org "B" to access repositories from "A", where this app is installed.
By setting skip_token_revoke to true it will give the chance to keep it active for some time which could be enough or even to continue to generate new token by running the Action several times.

Did i miss anything how to prevent this to happen?