Private Mapbox tileset accessible despite token scope restrictions

Private Mapbox tileset accessibility after token exposure

The goal is to confirm whether a private tileset remains protected when its access token is inadvertently published in a public repository, given that Mapbox tokens must be embedded in client‑side code for Mapbox GL JS or mobile SDKs.

Constraints include the token’s scope (e.g., styles:tileset) and the absence of an automatic revocation or rotation mechanism when a token is detected publicly; the service relies on users to rotate tokens manually or via external secret‑scanning tools.

Uncertainty surrounds whether Mapbox provides any built‑in detection, expiration, or scope‑tightening features that could limit the window of exposure after a leak.

Does Mapbox offer any automatic token revocation or rotation when a token appears in a public repository? If not, what are the recommended practices to reduce the exposure window? Are there any planned settings that would enforce token expiration based on usage patterns or detect leaked tokens?