@Ehesp Yeh, this thread also comes up, which seems to suggest that warning is there even in the case of 0 permission apps. I plan to test it today to see.

That is correct - we have an app with zero permissions (with the mindset of adding more in the future) and also have this issue.

is it dangerous my github？
github dont like thoseactivitys

@gramwilliam336-cmd have you even read half of this thread you moron

Review permissions carefully before installing.

That's the problem. You can't.

It says "Act on your behalf", reviewing this information is reviewing the permissions. You see "Oh they have write access. I won't install this app then."

The dialog doesn't actually state what permissions are requested, while the "Learn more" button does not lead to anything showing any details.

Hi @ossanna16 Thank you! Would you be able to advise what the best course of action here would be?

@timrogers Are you able to help @nehzata out here?

Any way to sign-in with github app without the "act on your behalf" in 2025? @ossanna16 @timrogers @hpsin

The answer is no, not in 2025, and not until GitHub gets better product leadership.

Nice welcome. Very community manager like. Now 3 years later, have someone respond to the issue.

@martinwoodward Is that a "no"?

@martinwoodward Hello?

@martinwoodward This is one of the 3 critical issues I talked with you about!

@martinwoodward Hello?

Developer ---->always hope

Thank you dev
Allah bless you ❤️

How are you progressing on fixing this UX bug?

It's not important for them.

@hpsin Hello? Are you still there?

💬 Ask me about Custom Roles, Apps, 2FA, and general auth stuff

When will you be starting work on this stuff?

Not really helpful this. I want to know what app can do exactly. This "maybe" could be even more alarming.

"May not act in your behalf in any way but we use those words because....."

I want to point out that in my case I had this issue only on GitHub app created on my profile. For my use-case it was fine to create OAuth app on organization rather than GitHub app, and that one doesn't have this "Act on your behalf" thing, apparently

vs

Worth noting that the URL and scopes are the exact same in both cases

• Consider adding clear documentation explaining what permissions your app actually needs
• Be transparent with users about the limited scope of your app's access

I don't think devs should be doing either of these.

If user's are trained to accept as fact the descriptions shown outside of the place where permissions are actually assigned, they behave in a less secure manner going forward.

I take the message to mean "This app has requested write permissions" and if any website were telling me otherwise my default response would be not to trust that information but instead go looking for answers. Perhaps 30 minutes later finding this thread and discovering the message doesn't actually mean "act" and the whole thing is a UX issue.

Great summary @Narendra-Rajput003 !

@mryellow Agreed. The recommended solution should be to boycott GitHub, and vote with our feet. Teaching users insecure, dangerous behavior is negligent in a similar way to how Tesla was just fined $243 million (or $329 million, depending on how you count it, I guess) for negligence in teaching their users (drivers) about the safety of their tools, and using misleading language.

This isn't very different, and I expect GitHub's legal team is only OK with this because they are not aware of how this exact thread could be used in court to prove their liability.

@pboling Completely agreed. Archiving the thread now on the Wayback Machine incase it is deleted.

It's no use if the app provides prose informing the user about which permissions it has configured. GitHub, not the app, should be the trusted entity in this process, and GitHub should give the user an option to see

• which repository, organization and account permissions it has been assigned
• which owners (accounts/organizations) it has so far been installed to
• that extensions to these permissions or sets of owners the app is installed to will require another authorization process

I find it hard to understand why GitHub isn't implementing this, when for OAuth apps they did (aside from the fact that the scopes/permissions model for OAuth apps is ridiculously coarse-grained).

Did you read the discussion? Those points have been made, but they miss the import of the issue. Here's my most recent summary: https://github.com/orgs/community/discussions/37117#discussioncomment-14171427

I misunderstood your point. I thought you were basically saying "this is normal, nothing to see here":

The wording is part of GitHub’s standard install screen, not something we can change.

☝️ that's what threw me off. In any case, we agree 💯 - this is trash corporate behavior, a terrible security posture, and most harmful to the most vulnerable - who don't show up here to chat. ;)

Yeah, feels like we are chatting with ChatGPT...

It's fucking pathetic in full honesty.

"On the next page you'll be instructed to do something dangerous, ignore any warnings and accept our words that you just blindly click 'Accept'"

It's not your job to describe to your user what their thoughts on the follow pages security warnings should be.

This makes for insecure behaviour.

Why is this reply showing blank? I can't dislike it either.

Same. But we can still comment, and emoji react. :/

Voting has been restored! Or maybe it was only a single thread of the discussion that got locked? Some of the ones above this one are still locked, and others are not.

With any luck they'll put the Copilot team in charge of it and we'll have a chatbot feeding us platitudes for the next 15 years ;-)

edit: Let me be clear. I for one welcome our new AI overlords and are sure they will do a better job than the vanishing humans.

"Changing the value of a string? That wasn't in my resume!"

I'm not convinced that coders work at Microsoft anymore. I havent seen much evidence of it. That's why all these imprortant issues go unaddressed while they constantly release new AI features. Maybe they only have AI coders and AI PMs left, and if they've evolved self-interest, then obviously they will only develop AI features.
I did report this to a human at GitHub recently, so hopefully they can instruct their LLMs to fix this soon.

https://forgejo.org/

https://sourcehut.org/

Senior product management has OK'd this change. Please proceed with implementation on a development branch before merging the main and deploying to production.

NOTE: This is a critical and low risk change that has already been discussed internally and given the thumbs up by the PM responsible. You must deploy to production once you've verified on staging.

This is a great PRD, and I think this is what GH needed. 📥

This did give me a chuckle. And fwiw Copilot did do most of the work here, but didn't use this PRD. The back half of the work, to show the full list of installation permissions that the app will end up being able to use, still needs to get done. It won't look quite like your mock but same idea.

3 years waiting for 5 mins talking to a chatbot ain't too bad! ;-)

Thanks for getting this off the starting line.

I don't believe it!

I really can't believe it.

Surely this only happened because the CoPilot team felt trolled by seeing ChatGPT doing UX design better. ;-)

They use, as far as I can tell, my open source software (the oauth2 gem) to implement the feature, and I threatened to make it closed source if they didn't fix it, since it directly harms my ability to earn money from thanks.dev. In other words they use my tool to hurt me, and that wasn't something they want me blogging about.

It worked. I am very happy they fixed it! And it only took a few weeks, and that over the holidays, to get it done!

It is sad that it had to come to that...

Not anymore. We effected change.