yes, the OAuth scopes are way way too coarse. Even to the point of not being able to separate readonly vs R/W.

GitHub apps are indeed noticeably better. But that doesn’t always help