I wrote about this a couple of years ago

https://games.greggman.com/game/github-permission-problem/

Github has (had) some of the worst wording in the permission prompts as well as too many 3rd party apps asking for blanket permission to do anything and everything in all your repos. It might as well be "hey, give us root on your servers and our new service will do cool things for you!"

And even worse is the 1000s and 1000s of repos that have signed up for those services including all kinds of popular libraries. They've given the keys to hack the libraries at will to 10s or 100s of random companies that integrate with github. It's insane.

> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository.

This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security.

Maybe GitHub will implement this feature now. My hopes are high.

Aren't OAuth tokens scoped to org? Wouldn't it be easier to create an org per repo? I guess it might get expensive depending on your usage/collaborators.

Edit: nevermind OAuth tokens are not org-scoped, only apps are

> If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository.

Just noting that gitlab has supported per repo tokens for ages. Yes, it's really useful, as this incident can attest.

All the oauth prompts I’ve gotten in the past 3 years or so seem to have the granular per-repo control you’re looking for.

Only "app installations" from the GitHub marketplace can be limited to specific repositories. For OAuth apps this is not possible sadly (everything that uses GitHub to login or connect accounts, e.g. Travis CI, Terraform Registry, Heroku).

Github already has per-repo scope, and has supported that for at least several years AFAIR.

Unfortunately no. GitHub Apps can be scoped to a repo, GitHub OAuth tokens cannot. A lot of things fall in the second category.

You’ll also discover this if you try to create a personal access token, it’s all repos, you can’t limit them to a particular repo.

Disturbingly, their own products like azure dev portal largely push you into such a grant-universal-access-for-every-contributor path

Their sec org is impressive, so these occasional massive things have been surprising