What makes GitHub Apps a more secure choice for automation over OAuth Apps?

Question

Options

• AGitHub Apps always require two-factor authentication.
• BGitHub Apps can only be installed by organization owners.
• CGitHub Apps are limited to read-only access and cannot write to repositories.
• DGitHub Apps authenticate as an app with fine-grained permissions, not as a user.

• A
  2% (1)
• B
  7% (4)
• C
  3% (2)
• D
  88% (52)

Explanation

GitHub Apps authenticate using their own identity with a scoped installation token, meaning they operate independently of any user account. This is the core security advantage: permissions are granted explicitly at installation time (e.g., "read issues, write pull requests on this repo only"), so the blast radius of a compromised token is tightly bounded.

Why the distractors are wrong:

• A - 2FA is a user account feature; GitHub Apps don't authenticate as users at all, so 2FA is irrelevant to them.
• B - Apps can be installed by anyone with sufficient repository/org access, not exclusively org owners.
• C - GitHub Apps absolutely can write to repositories; fine-grained permissions include write scopes.

Memory tip: Think of OAuth Apps as impersonating a user (inheriting all their permissions), while GitHub Apps act like a contractor with a badge - they have only the specific keys they were explicitly given, nothing more.

No community discussion yet for this question.