Add & update security considerations for PATs

doc/security/token_overview.md

@@ -117,4 +117,9 @@ Instead, API calls can be passed an access token using headers, like [the `Priva
 
 Tokens can also be stored using a [Git credential storage](https://git-scm.com/book/en/v2/Git-Tools-Credential-Storage).
 
+Tokens should not be committed to your source code. Instead, consider an approach such as [using external secrets in CI](../ci/secrets/index.md).
+
 When creating a scoped token, consider using the most limited scope possible to reduce the impact of accidentally leaking the token.
+
+When creating a token, consider setting a token that expires when your task is complete. For example, if performing a one-off import, set the
+token to expire after a few hours or a day. This reduces the impact of a token that is accidentally leaked because it is useless when it expires.

doc/user/profile/personal_access_tokens.md

@@ -62,6 +62,10 @@ to the URL. For example:
 https://gitlab.example.com/-/profile/personal_access_tokens?name=Example+Access+token&scopes=api,read_user,read_registry
 ```
 
+WARNING:
+Personal access tokens must be treated carefully. Read our [token security considerations](../../security/token_overview.md#security-considerations)
+for guidance on managing personal access tokens (for example, setting a short expiry and using minimal scopes).
+
 ## Revoke a personal access token
 
 At any time, you can revoke a personal access token.