3 ms·
Yeah, but at least with PATs (not sure about other token types), you can't scope them to a particular repo, so whenever you need to allow something to even see
by tomashubelbauer 6y ago
Yeah, but at least with PATs (not sure about other token types), you can't scope them to a particular repo, so whenever you need to allow something to even see a private repo or write to a public repo, the token you supply to allow that can do that for all repos and that alone is potentially really destructive. I am not sure if there is a good reason for why PATs can't be scoped to a repository, because if they were allowed to be, it would do a lot for security I think.
- RyJones 6y agoWorse: you can’t even scope it to an org, and some integration points are only available to org owners! GitHub is terrible.
- seg_lol 6y agoThat explains why at a place I worked we had multiple github orgs for different subteams, and/or they were really cheap ... yeah confused now.
- RyJones 6y agoWe also have multiple orgs, but we hit the requirement that you only have one bot account. It would be super nice if GitHub allowed much tighter scoping for PATs. I don’t know how many GitHub orgs the Linux Foundation has, but... hundreds? Having one bit account with wide permissions is a non starter