Many services integrate with github. Some of them seem to require a personal access token with "repo" permission. Personal access tokens are global across all projects. In other words you may want to use some external service to access just one project but by giving that service a personal access token you've giving it access to all projects. Further, a personal access token with the "repo" permission give access to basically do anything with the repo. Add commits, remove commits, send releases, etc.
Similarly some services ask you to authorize via Oauth to allow them to do anything and everything with your github account.
This seems to me like a security nightmare similar to Facebook asking for the username/password for your email but actually much much worse because not only can some company with a github personal access token or OAuth write permmission do someting nasty to your repo but via your repo, if that repo is popular, they can do something nasty to everyone using your repo.
As one example I saw this popular open source project (jszip) which is using this service (codeclimate) to rate their code coverage. I thought I might add it to my open source projects so I go to their open source page and click to sign up with github. That leads me it asking for these permissions
Given them write permissions seems like a huge security issue. That repo gets 2 millon downloads a week. At any time codeclimate or any disgruntaled employee could push a change to that repo that compromises some percertage of all the people downloading that repo.
Similarly electron-builder can be setup to put files in your releases but to do so it asks for a personal access token to your entire github all repos. This means they could easily push an update that pushes malware to all your repos (as opposed to just one repo).
Github has something called a deploy_key that is per repo but electron builder is not using that. Further, in their instructions on getting your 3rd party continous integration (CI) service to build for you and put the result in your releases they basically tell you to add your personal access token into the CI. That seems about as smart as giving some random stranger the keys to your house and withdrawl permission from your bank accounts.
It would seem like services like codeclimate should only need read permissions and would be shamed out of existance for asking for blanket write permission. For electron-builder similarly, designing such that it needs blanket permission across all repos seems also like very irresponsible design.
How is this not more of a concern? Developers are supposed to be more aware than the average user of security issues. Am I over reacting? Is this just something that's not a concern? I'm somewhat astonished that github doesn't have finer grained controls. For example for electron-builder, the only permission I need so to be able to allow the app to add files to a release. I'd prefer not to give it permission to do anything else like making commits or generating issues etc but given that Github doesn't even offer this more selective option I must be missing how this is super safe as is.
What I would expect is giant warnings for all of these features. That the norm would be the smallest permissions possible. Instead I seem to find the opposite which is the default being too many permissions, write access to all repos.
Am I worried about nothing?
Let my try to make my question clearer. My question isn't so much about my personal projects. My question is rather why isn't this a bigger topic. It seems like people should be screaming the software world is on fire and yet I've never heard anyone remotely concerned.
So I'm asking why isn't this "the software world is on fire and we're all going to die" situation. Why are there's not 100s or 1000s of articles screaming to all devs this is bad the same way sharing your email password is bad, worse actually since your email security affects only you where as your OSS repo affects potential millions of people. I can't find a single article on this topic.
Why aren't there articles by famous devs, the EFF, Mozilla, Google, whoever calling out bad practices and shaming devs that have given up the keys to their repos?
What am missing? Is this really not a worry? Am I over reacting?
