GitHawk + Private Repositories

[drs1980]

How does GitHawk handle the security of private repositories? Given the full private repo access granted by the OAuth scope, what precautions are taken to make sure that data from private repositories is not abused or sent to third-party servers?

[rnystrom]

We don’t have any third parties beyond Firebase and Fabric. All your data stays on your phone. Unless Google or Twitter are doing something awful, there shouldn’t be any risk!

_{Sent with GitHawk}

[rnystrom]

If you have more concerns please let us know

_{Sent with GitHawk}

[emmett9001]

It would be helpful to include this information in a Security FAQ page (something like this), since full read and write access to private repositories can be a big stumbling block for potential users of GitHawk who work in both OSS and proprietary codebases.
I'm happy to put together a stub of such a page if it would be useful, though someone closer to the project would still need to contribute to that PR.

Thanks for your awesome work on this app @rnystrom.

[BasThomas]

Would be awesome if you can draft something, @emmett9001!

[emmett9001]

Will do, I'll post here when it's ready for a look.

A feature request also occurred to me. It would be great for a user like me who works on both OSS and proprietary repos to have the option to only grant GitHawk permission to access public repos as opposed to unfettered repo scope. I don't know if such granular permission is supported by GitHub itself, but such an option would allow me to start using GitHawk without needing to get its security practices vetted by my company.

If it makes more sense to file this request as a separate issue, please let me know.

[emmett9001]

Comments and corrections welcome on https://github.com/GitHawkApp/GitHawk/pull/2069

[BasThomas]

Would be cool if you can open a separate issue for the thing you brought up @emmett9001, then we can close this one!

[emmett9001]

https://github.com/GitHawkApp/GitHawk/issues/2079