The GITHUB_TOKEN is created for each run and its rights are limited with the permissions key. The principle of least privilege means granting only what is necessary, for example contents: read, to reduce the impact of a compromised action.
Example
permissions:
contents: read