Security

GitHub App permissions

Every permission the Skipbox CI and Skipbox (personal) apps ask for, what Skipbox does with each, and what neither asks for.

View as Markdown

Skipbox CI (organizations)

Permission	Access	What Skipbox does with it
Organization: Self-hosted runners	Read and write	Adds a runner for each job that asks for one, and removes it when the job ends
Repository: Actions	Read	Sees when a job waits for its runner, lists your jobs on the dashboard, and reads your last 30 days of runs to recommend plans
Repository: Metadata	Read	Repository names, and whether each is private
Account: Email addresses	Read	Your address, for trial and billing emails

This app can't read your code. Each job checks out your code itself, inside its own VM.

Skipbox (personal)

Permission	Access	What Skipbox does with it
Repository: Administration	Read and write	Adds a runner to the job's repository for one job, and removes it when the job ends
Repository: Actions	Read	The same as above, and shows your workflow files on the dashboard
Repository: Metadata	Read	Repository names, and whether each is private

On a personal account, GitHub registers runners on a repository only with the Administration permission. It also covers the repository's settings, collaborators and deploy keys. Skipbox calls only the runner endpoints with it.

What neither app asks for

Contents, Workflows, Secrets and Pull requests. Skipbox never changes a workflow, never pushes, and never opens a pull request. Actions access is read only: it can't start, re-run or cancel a run.

What a job's VM holds

As on any runner, GitHub sends the job's VM your code, the secrets your workflow passes to the job, and a token for that job. Code the job runs can read them. They stay in that VM and are deleted with it. See VM isolation.

Change or remove access

On GitHub, open the app's Configure page to change which repositories it may use, or to uninstall it. See Cancel and uninstall.

Updated November 9, 2026