What GitHub access we use

GitHub access comes in two separate steps, and you control the second one entirely. Signing in identifies you and grants no access to any code. Code access happens only later, when a maintainer installs the CleverCrow GitHub App and picks the exact repos it can touch.

Signing in only identifies you

"Sign in with GitHub" uses GitHub to confirm who you are. The login reads your name and your organization and team membership (so we can check your permissions on repos you connect), and nothing else. GitHub shows you exactly this on its own screen before you confirm.

  • Your name and org and team membership
  • No repository access at sign-in: not read, not write

A Backer who signs in to fund issues but never installs the App has granted CleverCrow zero access to any code.

Code access is a separate step you choose

Repository access lives entirely in the GitHub App install, which is a maintainer action. When you install CleverCrow you choose exactly which repositories it can see, all of them or a hand-picked few, and you can change or revoke that selection in your GitHub settings at any time. The permissions below apply only to the repos you select. They never attach to your account just because you signed in.

What the App can do on repos you install it on

  • Issuesread and write

    Read your open issues and post funding updates and reactions, so backers and maintainers can follow a pool from the issue thread.

  • Pull requestsread only

    See the merged pull request that closes a funded issue, so the pool can settle and pay the maintainer. Merging is always your decision.

  • Metadataread only

    Basic repository details like name and visibility. GitHub grants every App this baseline read; it includes no file contents.

That is the complete list. The App has no access to your code: no Contents permission, no deploy keys, no git credentials of any kind.

What it deliberately won't do

  • Never touches code. CleverCrow reads issues and pull requests and posts funding updates; it cannot read or write your code at all.
  • Never merges anything. Settlement keys off pull requests you merged yourself.
  • Never touches repos you didn't select. Access is scoped to the exact repositories you chose at install.

Nothing pays out without your merge

Installing the App connects CleverCrow to your repos; it does not change them. A funded issue settles only when you merge a pull request that closes it. You can uninstall the App, or remove individual repos, from your GitHub settings whenever you like.