> I’m pretty sure GitHub did display what permissions the app was requesting. I don't understand why "sign in with GitHub" should grant any permissions whateve

> I’m pretty sure GitHub did display what permissions the app was requesting. I don't understand why "sign in with GitHub" should grant any permissions whatever. "Sign in" doesn't mean "grant this website permission to use my github identity". It means "have github confirm my identity to this website". To me this is both the website's and GitHub's fault for abusing what "sign in" means. The website shouldn't be asking for permissions in this scenario, and GitHub shouldn't be giving them.