For a while now I've been worried about this -- either integrations asking for full read/write access for a service that might seem to need only read.

Or maybe worse, integrations asking for access to anything my account has access to, when I only want to grant it to one repo or organization, or only to public repos and not private ones.

Whenever I've reached out to inquire/complain about this, I've been told that github does not give them granular enough auth settings to ask for less than this.

Is this true? I don't know. When I've tried looking at the relevant github docs myself, i quickly get confused.

Does anyone understand the github auth architecture -- does it need to be fixed to allow more granular access, or are integrations just not using it properly? Like... who should I be complaining to?