The product already exists, it's called OAuth. All you need is an additional role that you can authorize: CircleCI would like to: - Upload build a

The product already exists, it's called OAuth. All you need is an additional role that you can authorize: CircleCI would like to: - Upload build artifacts - Report security incidents Then in GitHub (or wherever), you have the aforementioned checkbox. So when CircleCI reports the incident, the GitHub account is locked down.