Tokens are saved to a file on the server and reloaded on restart, so you only enter them once. Leave a token field blank to keep the one already saved. They are stored in plaintext — keep the host locked down, and revoke/regenerate if it's ever exposed.
The sync only ever adds — it has no delete or force-push anywhere. Dry run lets you preview a run in the console before it touches anything. Description overwrite is the one place it replaces existing data, so it's off unless you turn it on.
Import missing pulls starred repos not yet in Gitea. Sync all also updates descriptions and backfills issues on repos you already have.