Don't worry - we don't touch your repos! Unfortunately the read permissions we need are classified as "write" (or at least we couldn't find a way to specify them as "read" in our very limited time).

GitHub doesn't allow enough specificity in application permissions. They don't need write permission, but they need access to Github orgs (obviously) and GitHub lumps them together.