Wrapped · 29 days
Proof of work.
It reads every commit you made at Colosseum, down to the branches you forgot about. You get one card.
GitHub will say act on your behalf. That is its wording for every app that reads repositories. This one reads commits and never writes: the permission it asks for cannot change a file, open anything, or post as you.
One image. Post it anywhere.
Everyone at Colosseum says they shipped. This is the part that can be checked.
One thing first
GitHub's next screen says act on your behalf.
It sounds worse than it is. Here is the whole of what you would be agreeing to.
- Read when you committed
- Read the names of the repos you pick
- Change a single file
- Post, comment or open anything as you
- Keep the key afterwards
Why we can't just turn it off
GitHub narrowed that warning in January 2026so it only appears when an app asks for a repository permission. Read counts. This reads commits, so it shows, and there is no setting that hides it. People have been asking for years: community #37117,"unreasonably alarming".
The one fix that would remove it is to drop the sign-in and use an installation token instead. We tried it. When somebody has already installed the app, GitHub treats a second visit as a reconfigure, drops the state and never returns them to the site: they land on their own settings page with nothing having happened. It isdocumentedas working that way on purpose, and other projects arestuck in that loopright now. Trading a scary sentence for a dead end is a worse deal.
The token is used for the length of the read and never stored. Nothing is written anywhere, because the permission it holds cannot write.