From 6c9681814e44e68ed8124414b745b40474a2951a Mon Sep 17 00:00:00 2001 From: Luca Casonato Date: Tue, 5 Mar 2024 13:19:45 +0100 Subject: [PATCH] docs: add faq on "Act on your behalf" --- frontend/docs/faq.md | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/frontend/docs/faq.md b/frontend/docs/faq.md index 2f3c6fa2..3f294aec 100644 --- a/frontend/docs/faq.md +++ b/frontend/docs/faq.md @@ -30,8 +30,6 @@ like `npm`, `yarn`, or `pnpm` with JSR. Yes. JSR is open source and licensed under the MIT License. You can find the source code on [GitHub](https://github.com/jsr-io/jsr). -> NOTE: The repo will be open sourced as soon as JSR is launched publicly. - ### How is JSR different from npm? JSR is designed to be a superset of npm, allowing existing tools that use npm to @@ -110,3 +108,26 @@ us at security@jsr.io. Please open an issue on the JSR GitHub repository at [jsr-io/jsr](https://github.com/jsr-io/jsr). + +### Why does JSR ask to "Act on your behalf" when I log in with GitHub? + +When signing in with GitHub, GitHub presents you with a screen that asks for +your permission to authorize JSR. This screen includes a list of resources that +JSR can access (only your email addresses and public profile information). + +This screen also contains the text "Act on your behalf" which suggests that JSR +can perform arbitrary actions on your behalf. **This is misleading, and not +true.** JSR can act on your behalf only to read any resources you have granted +it access to (your email addresses and public profile information). It cannot +perform arbitrary actions on your behalf. + +JSR can not modify your GitHub account, create repositories, create comments, or +do anything else that would be considered "acting on your behalf". GitHub +presents this "Act on your behalf" screen to all GitHub Apps, regardless of what +permissions they actually request. + +You can read more about this in +[the GitHub documentation](https://docs.github.com/en/apps/using-github-apps/authorizing-github-apps#about-github-apps-acting-on-your-behalf) +and in +[this discusion thread](https://github.com/orgs/community/discussions/37117) on +the official GitHub Discussions feedback forum.