Connecting GitHub

What it grants, what is stored, and how to check rather than trust.

You do not need to connect anything

Public repositories work with no account. Connecting is only useful for two things: counting private repositories, and spending your own GitHub rate limit instead of the shared one.

What is requested

This deployment asks for exactly what /api/meta reports under oauth_scopes, and the sign-in section on the front page states it before you click. GitHub shows the same list on its own consent screen — that screen, not anything written here, is the authority.

`read:user`	Your login name and avatar, so the page can say who is connected. Nothing else.
no scope	GitHub App mode. Permissions come from the app (`contents: read`), and you choose which repositories it may see when you install it.
`repo`	Only if a deployment explicitly opts in. This is GitHub's read and write scope for private repositories — classic OAuth Apps have no read-only equivalent. If you see this requested, it is worth asking why.

What is stored

Your access token	In Cloudflare KV, under a random 256-bit session id. It expires after 7 days. It is never sent to your browser.
Your browser	One cookie holding only that session id — `HttpOnly`, `Secure`, `SameSite=Lax`. JavaScript on the page cannot read it.
Your code	Never stored. Files are decoded, counted, and discarded as they stream past. Only totals are kept.
Private results	Cached under the commit sha like any other, but a cached private result is never served without re-checking that the caller can still see the repository.

What never happens

No write of any kind. The app only ever issues GET requests to GitHub.
Your repository contents are never written to disk, to KV, or to a log.
Tokens are never logged. The sign-in error path logs a message string only.
Nothing is sent anywhere except api.github.com and codeload.github.com, and the token is never attached to the second one.
No analytics, no trackers, no third-party scripts. The page's security policy forbids loading anything from another origin at all.

How to check

The whole thing is open source, so none of the above has to be taken on faith.

The source, in full.
src/worker/auth.ts — the entire sign-in flow, including what is requested and where the token goes.
src/lib/github.ts — every GitHub request the app can make. All of them are GETs.
/api/meta reports source_commit: the commit this running build came from. Compare it with the repository to confirm the deployed code is the published code.
The test suite asserts these properties rather than describing them — that a cached private result is not served to someone who has lost access, and that the token is sent to api.github.com and never to the archive host. Both fail if the protection is removed.

Revoking

“Disconnect” on the front page deletes the stored token immediately. To revoke from GitHub's side — which is the one that does not depend on trusting this site — use GitHub → Settings → Applications. Doing that is always the stronger move, and it works whether or not anything here is true.