GitHub connector needs org-installation-only mode and must not expose repos outside selected app installation

Open 💬 0 comments Opened Jul 1, 2026 by jflatow

What issue are you seeing?

Codex should support a strict "org installation only" GitHub access mode.

Right now, the GitHub App can be installed on a work org with access restricted to selected repos, but the required user authorization flow still asks to "act on your behalf" and "know which resources you can access". There is no way in that flow to explicitly deny access to personal repositories or limit the user authorization to only the already-approved org installation.

For coding agents, this is a serious permission-boundary problem. Users often have both work and personal GitHub access on the same GitHub identity. If Codex can use a user token path to discover or access repos outside the selected GitHub App installation, the selected-repo app installation is not a sufficient safety guarantee.

If the Codex GitHub App is installed only on a work org and only for selected repos, then Codex should have no access to private repositories under a personal GitHub account, even if authorizing the GitHub user identity to use the connector.

What steps can reproduce the bug?

The GitHub authorization screen asks for broad user authorization:

Verify your GitHub identity
Know which resources you can access
Act on your behalf
Email addresses: read

There is no UI to say "authorize this app only for the work org installation" or "exclude my personal repositories". There is no option to exclude personal repositories or bind authorization only to the selected org installation.

What is the expected behavior?

One should be able to configure Codex like this:

Install the Codex GitHub App on a work org.
Restrict the installation to selected work repositories.
Authorize their GitHub user only to bind/use that org installation.
Ensure Codex cannot discover, read, write, clone, open PRs against, or otherwise operate on any repository outside that selected installation scope.

In other words, the effective repository allowlist should be selected repos in the selected GitHub App installation, not anything the GitHub user can access.

Additional information

Why this matters

For AI coding agents, "act on my behalf" is not a minor convenience permission. It is the core attack surface.

Repo-scoped GitHub App installation gives users the impression that access is limited to selected repositories. If the connector can also use a user authorization path to reach repos outside that installation, then the user-facing permission model is misleading and unsafe for anyone who uses the same GitHub account for work and personal repos.

This blocks safe adoption for users who want Codex on work repositories but do not want to expose personal repositories.

Requested fix

Please add a strict access mode with these guarantees:

Allow users to bind Codex to a specific GitHub App installation, e.g. one org installation.
Show the effective repository allowlist before authorization.
Do not allow any user-token fallback to discover, read, write, clone, or operate on repositories outside that selected installation scope.
Provide a clear UI distinction between identity authorization and repository/content authorization.
Fail closed if a repo is not included in the selected installation.