Re:Dependency Confusion: How I Hacked Into Apple, Microsoft ...
by leetrout on Wednesday February 10, 2021 @05:27AM
(#26087514)
Apparently the Oauth scopes are much worse than GitHubs apps. Only GitHub apps allow read only access to the “metadata” by default whereas Oauth apps get access to the code, deploy keys, etc with no way to limit that access per repo.
https://docs.github.com/en/developers/apps/scopes-for-oauth-...
https://docs.github.com/en/rest/reference/permissions-requir...