Every refresh looked up the latest commit of every repository (up to 5000), which can exhaust the API's hourly rate limit and then surfaces as 'authentication failed'. Lookups are now cached per repo against its pushed_at, definite misses (404/409) included, and at most 100 new lookups run per refresh, most recently pushed first (F13).