Does my device store keep the service credentials, or do your servers handle all the third party communication?
Does every service you integrate with provide a suitably restricted oauth token, or are we trusting you with access to our most important iOS dev tools?
Our servers handle the 3rd party communication. We use read only tokens (or manual web hook integration) wherever possible, which today is everything but Github.
Github's oAuth permissions requires full write privileges to add a webhook. Hopefully that changes, but we're also adding manual integration shortly, for those that don't want to give oAuth access.