GitHub App
A GitHub App is an integration registered with GitHub that can use configured permissions to act through an installation or on behalf of an authorizing user.
Installation access and user access differ
GitHub Apps can automate repository tasks and connect external services. An installation grants access to an account’s resources within the selected permissions and repository scope. That deserves review even when the app promises a useful security or maintenance function.
GitHub documents three authentication contexts: the app itself, an installation, and an authorizing user. Installation activity uses an installation access token. User activity uses a user access token and is constrained by both the app’s permissions and the user’s permissions. An app-authenticated JWT has a separate role, including obtaining installation tokens.
Unlike a GitHub OAuth app, a GitHub App can act independently of a user. It can also use OAuth to act on a user’s behalf. Calling it an “app” does not tell you which context a particular operation used.
Review the work it can perform
A GitHub App is not the same credential as a user-created personal access token. Inventory installations and user authorizations separately from those tokens.
The maintainer handoff guide separates source, build, and distribution authority. The workflow approval article examines what approved automation can reach. Use those distinctions when deciding which repository permissions an integration needs.
If a security notification asks you to install or authorize something, verify the request through an established route before granting access. A security-themed name does not establish who operates the integration.