I am always uneasy when an application even thrust worthy like sentry asks access to ALL my private repositories even when they dont need it.
I feel that in 2022 GitHub is way too critical to many organizations and they should really work on stricter rules. Even google requires special and costly audits from oauth applications to access users critical data like drive and emails.
https://games.greggman.com/game/github-permission-problem/
Github has (had) some of the worst wording in the permission prompts as well as too many 3rd party apps asking for blanket permission to do anything and everything in all your repos. It might as well be "hey, give us root on your servers and our new service will do cool things for you!"
And even worse is the 1000s and 1000s of repos that have signed up for those services including all kinds of popular libraries. They've given the keys to hack the libraries at will to 10s or 100s of random companies that integrate with github. It's insane.
This. Limiting OAuth app access to specific repositories. I really wish this was a thing. For this exact reason I'm creating a new GitHub account for every new integration and share the repo with this account. It's technically against the TOS (they only allow single bot account per user) but there is no other way if you want security.
Maybe GitHub will implement this feature now. My hopes are high.
Edit: nevermind OAuth tokens are not org-scoped, only apps are
Just noting that gitlab has supported per repo tokens for ages. Yes, it's really useful, as this incident can attest.
You’ll also discover this if you try to create a personal access token, it’s all repos, you can’t limit them to a particular repo.
Their sec org is impressive, so these occasional massive things have been surprising