> But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and

> But I think that's the wrong learning outcome. Unless and until GitHub fixes its combination of allowing overly-broad authentication/authorization scopes and victim-blaming over abuse of said scopes, the above is precisely the right learning outcome. At the very least, if GitHub supports programmatically adding 500 stars, then it should be downright trivial to support programmatically removing those 500 stars and giving the user a slap-on-the-wrist warning if the user really is the one at fault.