The difference between a GitHub App and classic OAuth, why most changelog tools end up asking for more than they need, and what we did instead.
When you connect a third-party tool to your GitHub account, the permission prompt is usually the only security review that happens. Almost nobody reads the scope list closely — they read the tool's name and click Authorize. That single moment of trust is worth taking seriously, and it shaped a real decision in how we built Buoylog.
There are two common integration models. Classic OAuth apps ask for a scope — a bucket of permissions like repo — and once granted, that scope applies broadly across everything the token can touch. GitHub Apps are different: they're installed per-repository, with a fixed, declared set of permissions the app author chose ahead of time, and GitHub enforces that boundary at the API level, not just as a policy.
To read private pull requests, a classic OAuth integration typically has to request GitHub's repo scope — there isn't a narrower option in that model. That scope technically includes write access to your code, your settings, and your commits, even if the tool only ever reads PR titles. It's not that those tools want broad access; it's a limitation of the model they're built on.
Buoylog is a GitHub App, not an OAuth integration, and its declared permissions are read-only access to pull requests and repository metadata. Nothing else. It can't push a commit, open a PR, change a branch protection rule, or read your repository's secrets — not because we promise not to, but because GitHub's API rejects those calls for an app that never asked for the permission. See Security & permissions for the full breakdown.
See the permission screen yourself
Install the GitHub App and check exactly what it asks for — no surprises.
Start free trial →The permission screen during install is the fastest security review you'll ever get for free. If a changelog tool — or any tool that only needs to read a small slice of your repository — is asking for broad write access, it's worth asking why, or just checking whether it offers a GitHub App install instead of classic OAuth. The difference is visible in under a minute, before you've typed a single line of configuration.