I just built a test site with Netlify + GitLab. Why must I give it full access to all of my GitLab repositories? I just want to deploy 1 repo. Seems like that opens up unnecessary possibilities for a security breach.
It's the only option with the current OAuth model, however, we only use the token generated in your web browser, and talk directly to GitLab's API from there. We use the token to add a deploy key and a webhook to the specific repository we're linking to, and after that it's discarded. That way there's no long lived token stored on our end that has access to your whole account.