On: Mintlify GitHub read/write token leak

[oefrha]

Wrong. “GitHub Apps” always (?) had fine-grained repo-scoped permissions, it’s the “OAuth apps” that are stuck with coarse-grained permissions. So developers do have the option, it’s even the preferred option.[1]

> In general, GitHub Apps are preferred over OAuth apps.

[1] https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

[madeofpalk → oefrha]

"Always" is doing a lot of work here. Github Apps are relatively new.

[oefrha → madeofpalk]

If half a decade is new, sure. Except I was replying to someone claiming “I don't think GitHub will ever learn”, commenting on an article from a company created in 2021.

[junon → oefrha]

Even with apps, you still do not have the fine grained permissions you'd think you'd get. Have you tried?

[Ruepler → junon]

You can for sure. I am using it with Cloudflare pages for example. It's a matter of a click.

[oefrha → junon]

With apps, you can certainly grant access to individual repos instead of all repos. Yes I’ve tried.

Here’s how this thread went:

brycelarkin: Mintlify’s GitHub app asked for permissions to access all my repos.

You: Developers don’t have the option to not access all repos.

Me: False. GitHub apps do have fine grained permissions, as in they don’t have to have to access all repos.

You: Even with apps you don’t have fine grained permissions “you’d think you’d get”.

So what are you talking about? What’s the thing I’d think I’d get but not getting and how is that related to “permissions to access all repos” as discussed here?

[junon → oefrha]

Org access. You seem to be very hostile in your tone, by the way.