The site only requests read access to your email, as the login flow message _actually_ shows.

The "act on your behalf" statement is GitHub's standard message for all GitHub apps, regardless of whether they actually ask to be granted any permissions that would let them perform such actions. There's a "learn more" link right at that statement, that would've explained pretty much exactly this. I find it curious that you bothered to venture into docs and link them, but did not bother to click _that_ one to understand what's actually going on.

It says, i.a.: "The GitHub App can only do things that both you and the app have permission to do.". Since the site only asks for read access to your email address, it cannot actually do anything else. As simple as that.

I hear you, and it's possible you're right, but that's not what the dialog said and the very link that you mentioned has -- as its very first sentence -- "Once you authorize a GitHub App, the app can act on your behalf." and shows an example of commenting as me

So, I guess just to vote on a cool game I should definitely roll the dice with my github account and trust that some Internet comment is right, or, I guess upvote and be sad for them that they tried to be kewl by creating a GH app instead of oauth2 like a sane person. Naming it "Kilobot" for sure inspires confidence for its fewer than 1k installed users, too

Once again, curious that you bothered to remember something that is relevant to community inside jokes and take dumps on that, even bothered to remember a number, but did not bother to read up on what you're dumping on.

FYI #1 It very much is a standard oAuth2 flow. Just GHs 'always on' message is unfortunate, and that's all there is to it. There's been topics like https://github.com/orgs/community/discussions/37117 on this ever since they had been introduced. Which, again, you could've encountered if you put your energy into good faith, instead of focusing that bad faith mojo on a small community. If you really feel like proving how "sane" and above "kewl" you are, go take your dump on GitHub - i.e. the one actually responsible for those misleading messages.

FYI #2 Your vote would not count anyway, because only community member votes actually get included in scoring. Although as an outsider you'd been welcome to leave feedback.

I didn't have to "remember," they're on the tab right next to this one. I'm sorry you're butthurt about someone wanting to vote who isn't a part of the l33t insiders club. Anyway, right under the game in question it says "Voting for this edition's games is in progress - sign in to vote on this game." so how would any sane person know that it's only for insiders?

Sorry I raised your bloodpressure about something that doesn't matter to you since I'm an outsider. I'll send you virtual flowers using my totally safe GitHub App

GitHub has been a partner of the competition for years now. They help actively promote it, participate in providing feedback to contenders, integrate it with the platform (https://github.com/topics/js13kgames). The competition is organized by https://stars.github.com/profiles/end3r.

But yeah, sure, you're free to tell yourself whatever you want.

And no, it's not only for insiders - thus the message. Outside votes get whitelisted when they meet the compos fairness criteria. It's not a popularity contest. Your vote would not count on this basis (amongst others).

Thank you! :) And yeah I'll ask the orgs why does the bot request these permissions, might be an oversight.