Thanks! Yeah, it’s strangely worded for what it is. We’ve emailed GitHub about it. Our permissions are read-only but since we read “on your behalf” this is technically true.

Why don't you read on your own behalf. You don't need this permission at all. It's just to harvest email addresses right?

Private repos are one reason we'd need it, and this also gives us higher rate limits so that lots of people can use it concurrently.

Presumably if you have a private repo, they need permission to read it.