>For a security related product, this creates a huge attack surface and audit requirement.

We agree. We spent a lot of time debating this.

We originally set out to build a gem, but realized it was so much easier to use through GitHub. Unfortunately, we can't provide more granular access due to what the API gives us.

We plan on eventually releasing said gem, as noted in the "I don't use github" link on the front page :).