App A writes the master catalog that the customer-facing Quoter reads. Supply a GitHub Personal Access Token with contents:write on the target repository.
api.github.com over HTTPS. This page has no server. Anyone with access to this device (or to a browser extension able to read storage) can read a remembered token — prefer a short-lived, fine-grained PAT scoped to this one repository, and use Clear credentials when you are done.