Ask HN: Developer abused “sign in with GitHub”?

Re:Ask HN: Developer abused “sign in with GitHub”? by grumple on Friday December 09, 2022 @07:27AM (#33920507)

Github does not separate starring. It falls under the public_repo scope, which is one of the fundamental scopes. Source: https://docs.github.com/en/developers/apps/building-oauth-ap...

"public_repo Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositories."

[ Parent | on HN ]

Re:Ask HN: Developer abused “sign in with GitHub”? by masklinn on Friday December 09, 2022 @08:59AM (#33921269)

FWIW under the new fine-grained permission model (used by github apps, and the fine-grained personal access tokens currently in beta) "starring" is its own account-level permission: https://docs.github.com/en/rest/overview/permissions-require...

[ Parent | on HN ]