The #GitHub #OAuth support is so painfully coarse.

You cannot give a 3rd party read access to one private repo. If you want that, you must give it read+write(!) access to all repo's(!) in that organization.

And if you want to log in to that 3rd party service on behalf of that organization, you must *also* give it write access to all your personal repo's. Like wtf?

(in this case I'm talking about #CircleCI, but unless I'm mistaken it's a #GitHub limitation, not a #CircleCI one)