Comment by transitivebs

I've used the GH API extensively, and this is a common misconception. The default (no scope) allows you to access public repository info (source: https://developer.github.com/apps/building-oauth-apps/unders...).

This GH app, for instance, received similar feedback and its author removed the offending scopes without losing functionality: https://news.ycombinator.com/item?id=11261953