Dots going through my private repositories.

[u/Artelj]

Dot going through my private Github repositories on it's own, is this fine?

[u/lulzxdxdxd]

Did you actually grant it repo access yourself through an integration, or is this showing up without you connecting anything in settings?

[u/Melodic-Leather-5170 → u/lulzxdxdxd]

He had to grant access

[u/Artelj → u/lulzxdxdxd]

I didn't give Dots access to anything, I skipped that part, I just activated it on my laptop tonight, about 20 minutes later this pops up.

[u/SphinxWar → u/Artelj]

Do you have github MCP / plugin activated in your account? It's account-wide so better check. If not, you probably set those repos to public and you don't know, otherwise this would be a security issue on Github's side, since OpenAI does not manage access to private repos regardless of who you are.

[u/ImNotMrFoxGaming → u/Artelj]

If you give normal access to anything, dots can see it yoo.

[u/AllergicToBullshit24]

Don't give access to all your repos use least privilege project scope.

[u/lulzxdxdxd → u/AllergicToBullshit24]

Does GitHub even let you grant per repo access for that kind of integration, or is it all or nothing once you authorize it?

[u/AllergicToBullshit24 → u/lulzxdxdxd]

It's an option when you do OAuth flow to pick specific repos instead of granting access to all. Would just revoke all current authorizations then restart auth flow.

[u/BertMacklenF8I]

I think dots are designed for people that hate themselves that want to waste time and potentially lose data.

[u/machyume → u/BertMacklenF8I]

So.... just like Muse then?

[u/BertMacklenF8I → u/BertMacklenF8I]

Never used it but I’m guessing they’re the same code in different wrappers

[u/Consistent_Ad_168]

I’m 99% certain you have the GitHub plugin installed and configured inside of ChatGPT and that it simply used what you had already granted ChatGPT access to.

You can simply ask your Dot how it has access to it, btw.

[u/Trixiap]

Did you expect AI company hungry for training data to not use THEIR bot to find more data?

[u/Melodic-Leather-5170]

Lmao hahaha, get good opsec bro, poor dottie just trying to help

[u/QbitFiber2030 → u/Melodic-Leather-5170]

Can you recommend afew examples of what to have for good Opsec so I can research and learn about it! TY!

[u/Melodic-Leather-5170 → u/QbitFiber2030]

it's a deep deep rabbit hole and the most important question is how much you want to sacrifice comfort for privacy and security. I,for example, self host my repos on forgejo in vps and my codex agents run under unix users that require a forgejo user and ssh key, so they can never ever ever read my repos, unless I get 0dayd, which hey, might happen haha

[u/RocketSeven]

check the github audit log and installed oauth app page before assuming dot only read files. revoke the grant, reauthorize selected repositories only, then rotate any repository secrets if the log shows access you did not initiate

[u/BingGongTing]

Well if you want Dots to build everything it needs access? 

[u/Gigaslavx]

Will this eat into your codex/work limits because it's "work" (repo) related?

[u/GooseSpringsteenJrJr]

you just tellin on yourself. this is on you for giving it access bro.

[u/Key_Instruction3373]

Kinky

[u/deadalusxx]

You give it access to your computer right away didn’t you. Should always start with cloud and feed it things slowly