Connect GitHub and OAuth Providers Without Over-Granting Access

OAuth is an authority boundary, not just a sign-in step. In OpenPond, connect a provider only when a Project, Sandbox, Agent, or Workflow has a specific use for it, and keep the resulting scope reviewable.

Connect GitHub for a Project

To import an existing repository, open Sandboxes → Projects, choose Create project, then select Import source. If GitHub is not connected, choose Connect GitHub and complete the authorization in the provider window. Return to OpenPond, select the repository and branch, then finish the Project setup.

That connection lets the Project establish its source identity. It does not turn every Sandbox or Agent into a general-purpose GitHub administrator.

The public OpenPond repository is a good example of source you can inspect before connecting it to a Project.

Connect another OAuth provider

Open Sandboxes → OAuth, choose the provider, inspect the requested scopes, and connect it only when they match the task. OpenPond records the connection and exposes audit activity so a team can understand what was authorized.

Keep the permission model small

• Request the narrowest scope that supports the task.
• Keep credentials and OAuth tokens out of source, prompts, Skills, logs, and screenshots.
• Review provider permissions before accepting them.
• Disconnect a provider that is no longer needed.

An Agent or Workflow still needs appropriate configured authority to use a connected provider. A connection alone is not permission to take unrelated actions.