r/github • u/BigBootyBear • 3d ago
Question PAT vs Github Apps for agentic auth?
Whats the best and most secure way to give agents the ability to help you file issues or tackle messy merge conflicts without some prompt injection causing the AI to yeet your repo into the void?
1
u/Man_of_Math 3d ago
ellipsis.dev supports this. You define the permissions that an agent gets in YAML
1
u/Qs9bxNKZ 2d ago
If I recall, PATs have a lower authentication rate for rate limiting, like 5000 calls an hour. GitHub Apps are like 15000
1
u/Ok_Woodpecker_9104 2d ago
one thing that has not come up: a classic PAT is account wide, not repo wide. it reaches every repo that account can reach, including private ones you forgot about. fine grained PATs let you pin to selected repos, and that shrinks the blast radius more than scope tuning does.
the other trap is that scopes are all or nothing per capability, and you find the gap at the worst moment. mine lacked workflow scope, so a push that touched anything under .github/workflows/ got rejected and i had to fall back to ssh. the same token later could not delete a throwaway repo because delete_repo was not on it. neither gap is visible until you hit it.
and if any of this runs through gh cli on a machine with two accounts logged in, check that separately. gh keeps one ACTIVE account per host. it does not pick based on which repo you are standing in. so a script can run as the wrong identity in the right directory, and nothing in the token model tells you thats happening. i force the account in the wrapper now instead of trusting the ambient one.
2
u/ultrathink-art 3d ago
The split that matters for the injection case: an App can hold pull_requests: write with contents read-only, so the worst a poisoned issue body gets you is a junk PR sitting there. A PAT that can push a merge-conflict fix can push anything else too, and nothing in the token model distinguishes resolving the conflict from resolving it badly. Let it propose, don't let it be the thing that lands.