GitHub's Permission System is Flawed

_This is an open letter to @GitHub on behalf of third-party app developers._ For a very long time, [permission scopes](https://developer.github.com/v3/oauth/#scopes) has been a common issue for both users and app developers. These scopes are extremely permissive and far too broad, preventing users from using third-party applications. We need a more granular permission system and we hope you listen to this. Below you can find some examples that describes exactly what we mean by how flawed the system is and some suggestions to improve it. --- ###### `gist` scope > _Grants write access to gists._ Let's say you want to build an app like [GistBox](http://gistboxapp.com) to organize gists. In order to read **read private gists** you would need to request the `gist` scope. Here's what users would see: <img width="425" alt="gist" src="https://cloud.githubusercontent.com/assets/398893/12970272/538a35a8-d041-11e5-9332-242d9f5b7da1.png"> Even if you don't want to create any gists, you still need to request write access. Some users may find that ok, but other users can be afraid of having someone creating or editing their precious code snippets. **Solution:** what if we had `read_public:gist`, `read_private:gist`, `write_public:gist`, and `write_private:gist` instead? --- ###### `public_repo` scope > _Grants read/write access to code, commit statuses, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositor

Posted by zenorocha on Feb 11, 2016, 7:32 AM

Tags

• github (SaaS)

Related issues

• 2026 - Microsoft Office 365
• [Ubuntu] `ubuntu-latest` label will use Ubuntu 26.04 in November 2026
• Gamut mapping
• [Codex Desktop] Editing and resending a queued message triggers "App-server queued follow-up no longer exists"
• [Windows] ChatGPT 26.820.60940 fails with "invalid transport in mcp_servers.codex_app"; Beta 26.727.40816 works
• [BUG]: infinite loading of videos