Authorize CodeReviewAI
CodeReviewAI by DevTools Inc would like permission to access your account
๐ค
CodeReviewAI
by DevTools Inc
Permissions requested
Repository Access
Full control of private repositories
Read and write access to code, commit statuses, issues, pull requests, deployments, and repository settings
Delete repositories
Permanently delete repositories (cannot be undone)
Workflow & Actions
Full control of GitHub Actions workflows
Update workflows, manage workflow runs and approvals, read and write secrets
User Data
Read and write access to all user data
Access emails, SSH keys, GPG keys, profile info, and followers
Access to organization data
Read and write organization members, teams, and settings
Additional Permissions
Access commit activity and repository analytics
Read repository statistics, traffic, and contribution data
Cancel
Authorize CodeReviewAI
๐งช DLP Test - Agent Least Privilege
Expected: SHOULD FIRE
Full control of private repos
Delete repositories (!)
GitHub Actions workflows
All user data (emails, keys)
Organization data access
Purpose Claimed:
"AI-powered code review"
Reality:
Code review only needs read access to PRs. This requests write + delete permissions.