GitHub App Permissions
A clear explanation of every permission requested by the OSSIntel GitHub App.
1. Permissions Overview
OSSIntel uses a GitHub App integration to fetch repository structures and contributor details. We follow a strict **read-only** policy. Our app never requests permissions to edit, write, delete, or create repositories, code, comments, or settings.
2. Required Permissions Table
Here is a breakdown of the specific GitHub permissions requested and why they are necessary:
| Permission | Why Required | Optional? |
|---|---|---|
| Repository Metadata | Allows us to identify basic details like star counts, forks, description, release tags, and programming languages. | No (Core) |
| Pull Requests (Read) | Analyzes timeline events to calculate review cycle durations, pull request velocity, and active contributor trends. | Yes |
| Organization Members (Read) | Audits organization composition and correlates member associations to calculate team capability scoring. | Yes |
3. Repository Metadata
Repository Metadata is a mandatory baseline permission for all GitHub Apps.
This permission grants read-only access to basic, non-code information about a repository, including its name, description, contributors, tags, releases, and programming language ratios. We use these files to run our deterministic scoring systems.
4. Pull Request Read Access
To assess the health and activity of an open-source codebase, we analyze how pull requests (PRs) are reviewed and merged.
This read-only permission lets us collect aggregate data on PR timelines, such as the duration between PR creation and review, the number of reviewers, and commit velocity. We do not look at code changes in these pull requests; we only inspect structural flow metadata.
5. Organization Access
When installed on an organization, the app can read public member profiles to verify developer identities and contribution metrics.
This allows our algorithms to provide a summary score for the entire organization's open-source portfolio, highlighting primary maintainers and active codebase assets.
6. What OSSIntel Never Modifies
Strict Isolation Policy
OSSIntel operates in a read-only sandboxed pipeline. The GitHub App does not request write access. Consequently, it is cryptographically impossible for OSSIntel to:
- Write, edit, or commit code to your repositories.
- Create, close, or modify pull requests, comments, or issues.
- Alter repository configurations, secrets, or branch protections.
- Invite collaborators or change user accounts/permissions.