That [1] is how "ask only for e-mail", "proper" "just" SSO looks like. While sure it isn't immediately expected to access "stars" feature when you give public

That [1] is how "ask only for e-mail", "proper" "just" SSO looks like. While sure it isn't immediately expected to access "stars" feature when you give public repo access... ...you're giving it fucking repo access. That's WAY more (on a "how bad it can be if you get hacked") permissions than just starring.