Hacker News Reader

Comment by ghuntley | Hacker News Reader

    > This application will be able to read and write all user data.

Fix your permissions please, sounds useful but no way are you being granted full read/write to personal and organization repos.

View on HN

Actually after looking into it the current permissions are:

Grants read/write access to profile info only. Note that this scope includes user:email and user:follow.

Still too broad, but it doesn't give access to repos. I will change it to only user:email as soon as I get off my daily job.

Github shoukd rename it into "profile data" then. "User data" seems easy to misinterpret.

It's been a while since I tested it, but I believe that reading public info like stars and following/followers requires no scopes. I only needed that scope for writing. May be worth checking out?

Yeah, i was about to sign up but didn't because it was asking for too much permission.

I fixed the issue :)

Ugh. Nice find, I'll fix that asap!

Would it be possible to have it access only your personal profile data? The permissions screen shows an Organization Access section with all my orgs checked.

Unfortunately I can't exclude organisation altogether, GitHub applications have access to organisation with the permissions that the user has allowed the app. However now GitHub Notifier only asks for read permissions :)

Reply on news.ycombinator.com