Is the token not keyed to a specific source? I would have expected it to operate similarly to an SSL cert, where part of the verification process is that the source is the correct origin that the token belongs to - so if someone just lifted a valid cert to put into a malicious one, it would catch anything from changing a single character in the project name to changing the repository host (i.e. GitHub to GitLab)
It absolutely should not have been named zeroth() because the reasoning for that is purely pedantic and ignores WHY arrays are 0 indexed. It’s not like the people in the early days of writing programming languages were saying “the zeroth item in the array” - they would refer to it using human language because they are humans, not machines. Arrays are 0 indexed because it’s more efficient for address location. To get the location in memory of an array item, it’s startingAddress + (objectSize * index). If they were 1 indexed, the machine would have to reverse the offset.
Function/Method names, on the other hand, should be written so as to make the most sense to the humans reading and writing the code, because the humans are the only ones that care what the name is. When you have an array or list, it’s intuitive to think “I want the first thing in the array” or “I want the last thing in the array),” so it makes sense to use first and last. That also makes them intuitive counterparts (what would be the intuitive counterpart to “zeroth”?).