Comment by entelarust

Quick theoretical senario...

User signs up to try circleci for a private project of theirs. Grants read access to their private repos via github oauth

User also has many other private repos (company they work for, open source projects, forks, etc)

Could they have used the stored github credentials from circleci to clone every private repo in full the user had access to?