1 result found

1. Create GitHub App as alternative to GitHub OAuth

   Gearset currently uses OAuth to connect to GitHub, and the way that works is that the OAuth connections have permissions to all repositories that my user has access to, which from a security perspective is a problem, because if the github key were ever compromised, it would provide very broad access to customers GitHub organizations.

   Security teams would feel much better with the ability to limit the scope of access to just one repo instead of all the repos that my GitHub user has access to, which can be accomplished by creating a Github App which can be installed for an individual repo.

   Quote from GitHub docs: "GitHub Apps are the officially recommended way to integrate with GitHub because they offer many advantages over a pure OAuth-based integration"

   https://docs.github.com/en/developers/apps/getting-started-with-apps/migrating-oauth-apps-to-github-apps

   https://docs.github.com/en/developers/apps/getting-started-with-apps/differences-between-github-apps-and-oauth-apps

   Gearset currently uses OAuth to connect to GitHub, and the way that works is that the OAuth connections have permissions to all repositories that my user has access to, which from a security perspective is a problem, because if the github key were ever compromised, it would provide very broad access to customers GitHub organizations.

   Security teams would feel much better with the ability to limit the scope of access to just one repo instead of all the repos that my GitHub user has access to, which can be accomplished by creating a Github App which can be installed for… more

   10 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   3 comments  ·  Integrations and connections (Jira, source control, DX etc.)  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close
   Started  ·  AdminGearset Team (Feedback Manager, Gearset) responded

   We are working on this, and hope to release this shortly.