Attack campaign involving stolen OAuth tokens issued to third-party integrators
If one thing can be gotten from that incident is forcing GitHub to create finer OAuth scopes and per repository.<p>I am always uneasy when an application even thrust worthy like sentry asks access to ALL my private repositories even when they dont need it.<p>I feel that in 2022 GitHub is way too critical to many organizations and they should really work on stricter rules. Even google requires special and costly audits from oauth applications to access users critical data like drive and emails.