Does Github assess applications that uses Github as base?

[fabriziodidthis]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Body

Hey guys

question... i've been trying to find a solid answer on GH docs but with no success... I built a huge application that uses GH heavily not just for login, but that has several gray areas on GH docs regarding its usage... so, is there any real GH employee here, preferably legal part, that could not just help me to solve those questions but also to, if possible, take a look in the application and evaluate if everything is fine or not? I'm not really willing to get sued in my first week of business but I'd love to have some legal guidance, if possible

Any help is appreciated

Thanks

[ahmeds-machine]

hello. The answer depends entirely on how the application is being distributed:

Standard OAuth Apps / GitHub Apps: If a developer just creates an app in their Developer Settings and shares the installation link, GitHub does not proactively assess or review it. Users install these at their own risk. However, GitHub will intervene and suspend the app if it gets reported for violating the API Terms of Service or malicious behavior.

GitHub Marketplace Apps: If the application is being submitted to the official GitHub Marketplace, GitHub does perform an assessment. They require a review process that checks for security vulnerabilities, proper branding, and overall user experience before it is allowed to be listed publicly.

Let me know if you were wondering about a specific type of application!

[fabriziodidthis]

none of these mentioned points applies to the application... is more about a huge gray area about PII or not on an application