Lmao the victim blaming on this one.
Github failed to indicate clearly what the consumer was going to use this person's credentials for.
This is Github's fault, end of story. If the permissions included "can star repos", instead of just "can read/write repos", then sure.
Github are too _lazy_ to build granular enough scopes; they should be able to ask "why are you using this scope?" and it should _never_ be the case that someone using one small part of the api has to ask for a scope granting blanket access.
Granted, there are quite a few issues with granularity of scopes/oauth for various other services, too.
Edit: also the stinking elitism in here; the worst part of the tech community. Just bc someone has a Github account doesn't mean they're some sort of super hacker, there are junior devs out there who could've easily done this and your response to them is "get gud scrub".
Github failed to indicate clearly what the consumer was going to use this person's credentials for.
This is Github's fault, end of story. If the permissions included "can star repos", instead of just "can read/write repos", then sure.
Github are too _lazy_ to build granular enough scopes; they should be able to ask "why are you using this scope?" and it should _never_ be the case that someone using one small part of the api has to ask for a scope granting blanket access.
Granted, there are quite a few issues with granularity of scopes/oauth for various other services, too.
Edit: also the stinking elitism in here; the worst part of the tech community. Just bc someone has a Github account doesn't mean they're some sort of super hacker, there are junior devs out there who could've easily done this and your response to them is "get gud scrub".