I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are will

I think learning outcomes are simultaneously: 1. If you can't be bothered to read the terms, then don't use OAuth. This is GP's conclusion. 2. If you are willing and able to carefully read the scopes, and you are willing and able to abandon the app if the scopes are too broad, and you comprehend the meaning of the scopes, then use your discretion. But that's a lot of conditions, so... 3. All scopes should be revokable by the user, and potentially spoofable at their discretion. 4. The resolution of scopes should strike a balance between being understandable and following the principle of least privilege. 5. GitHub and other OAuth hosts (even all app platforms?) should audit apps for misbehavior, both in abuse of permissions and unnecessary permission requests. Especially when the user regrets the actions taken by the app.