Actually after looking into it the current permissions are:
Grants read/write access to profile info only. Note that this scope includes user:email and user:follow.
Still too broad, but it doesn't give access to repos. I will change it to only user:email as soon as I get off my daily job.