Ask HN: How can the Vercel GitHub App create a repository without my permission?

[ipselon]

Hello!

I'm a bit surprised! How is it possible for the Vercel GitHub App to create a new repository on my GitHub account, even though I only gave it permission to access one of my existing repositories?

Also, I found out that the GitHub App doesn't have access to an API that can create new repositories on a personal account.

Even though the Vercel GitHub App acts on my behalf, it didn't ask for permission to access the 'repo' scope when requesting a personal access token.

[andrewfromx]

"To create a new repository using the GitHub API, your personal access token needs to have the repo scope or permission. This permission grants full control of private and public repositories, including the ability to create new repositories." You probably give the "repo" scope but it was phrased as just giving access to one repo.

[ipselon]

Vercel does not require authorization through GitHub, so it does not receive my personal access token.

Vercel does all operations with a GitHub account through its GitHub App, which the user can install on his account and give permission to access the repositories. That's why I don't understand how Vercel does create a new repository.

[andrewfromx]

wait try this:

"You can see what scopes your personal access tokens have by going to the "Settings" page of your GitHub account and clicking on "Developer settings" in the left sidebar. Then click on "Personal access tokens" to see a list of your tokens.

Each token in the list will show the scopes that it has been granted. You can click on the name of a token to view its details, including its scopes."

Is there any token there with repo?

[ipselon]

Yes, I checked, there is no any token that was granted to Vercel.