# Private repos shown for set up **URL:** \ **Category:** Bug Fixes\ **Tags:** github\ **Created:** [April 22, 2022, 6:57am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595 "2022-04-22T06:57:04Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [April 22, 2022, 6:57am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/1 "2022-04-22T06:57:04Z")
_If you are using GitHub, have you tried adding the [Codecov GitHub app](https://github.com/apps/codecov)?_ No All fields below are required. ### Description After authorizing Codecov, and sync, the landing page shows private repos ready for set up. The default is public only, why are private repos shown? Also, why is this option not presented to me when asking for GitHub authorization? I should be able to grant access to public repos only. There’s a [support article](https://codecov.freshdesk.com/support/solutions/articles/43000593950-cannot-access-repository-on-codecov-permissions-) to enable access to private repos, but it doesn’t state the obvious, how not to provide access to private repos. ### CI/CD URL N/A ### Codecov Output N/A ### Expected Results Private repos shouldn’t be shown by default. ### Actual Results Private repos shown by default. ![Screen Shot 2022-04-21 at 2.56.19 PM](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/0/094a61d48d51816337a19271968cf4e7f457338b.jpeg) ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [April 26, 2022, 7:03pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/2 "2022-04-26T19:03:06Z")
Is this bug report pending triage? ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 2, 2022, 11:55pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/3 "2022-05-02T23:55:42Z")
@bruce-wayne private repos do not show up unless they have been specifically granted during a GitHub oauth flow. If you want to revert this, you will need to revoke oauth access for Codecov in your GitHub settings and log back into Codecov again. If you see the request for both public and private in the GitHub oauth flow, you may need to remove `private=true` or something similar from the URL. ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 4, 2022, 3:31am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/4 "2022-05-04T03:31:22Z")
I didn’t grant private repo access specifically, simply clicked on login. I have also revoked permission and logged in again, to no avail. ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 4, 2022, 9:08pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/5 "2022-05-04T21:08:40Z")
@bruce-wayne can you confirm that you revoked permissions from [here](https://github.com/settings/applications)? ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 5, 2022, 3:10am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/6 "2022-05-05T03:10:47Z")
AFAIK, that’s the only way to revoke permissions. ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 5, 2022, 3:23am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/7 "2022-05-05T03:23:03Z")
@bruce-wayne can you show me a screenshot of the GitHub oauth flow when you sign in to Codecov after revoking permissions? it should look like ![image](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/c/c18832553329b9f29113bac93119a918f9012b52.png) ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 6, 2022, 3:38am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/8 "2022-05-06T03:38:31Z")
![Screen Shot 2022-05-05 at 8.33.58 PM](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/7/7da94101dd5e0a3bf9aaa76dcf0e854c68e533fa.jpeg) There is no option to opt out private repos, which is why this ticket exists. I also tried by manipulating the URL (instead of clicking on the login button), to no avail. `https://codecov.io/login/github?private=false&redirect=github/` This is a security issue. ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 17, 2022, 4:24am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/9 "2022-05-17T04:24:59Z")
@bruce-wayne, we are working on a UI update that will more explicitly show `private` scope as a selection. To opt out of private scope, you can update the login URL of the oath screen from `https://github.com/login/oauth/authorize?response_type=code&scope=user%3Aemail%2Cread%3Aorg%2Crepo%3Astatus%2Cwrite%3Arepo_hook%2Crepo&client_id=...` to `https://github.com/login/oauth/authorize?response_type=code&scope=user%3Aemail%2Cread%3Aorg%2Crepo%3Astatus%2Cwrite%3Arepo_hook&client_id=...` Note the removal of `%2Crepo` near the end of the URL. You should see a screen that looks like ![image](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/b/bc5ccf4e975784c5c78bf4bca6978c862a85dbab.png) ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 18, 2022, 6:53am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/10 "2022-05-18T06:53:10Z")
That doesn’t help. It removes the repository access request, but after logging in, private repos are still shown. What’s even more ridiculous is that the screen claims to show public repos only. I’ve revoked Codecov access from GitHub, because I can’t allow an app that’s sneaky. ![Screen Shot 2022-05-17 at 11.49.06 PM](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/4/473e3d2fe95c12300b71e14d8c3087d2061819e1.jpeg) ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 24, 2022, 6:04pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/11 "2022-05-24T18:04:44Z")
@bruce-wayne my fault, this definitely shouldn’t be happening for you. Can you send me send me a DM with proof of ownership to the GitHub username `asakar` and we will delete your private repos. On sign-in after that, please remove all Codecov cookies and be sure to set `public only` in this dropdown ![image](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/9/987584700f7736f47d2a26905b0fc35493c782e1.png) ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 24, 2022, 6:07pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/12 "2022-05-24T18:07:15Z")
Also, from our [security FAQ](https://about.codecov.io/security/) ```plaintext Does Codecov store source code? We do not store source code. Some archived raw uploads may contain source code, which you can elect to disable. There is only one opportunity for source code to be stored: while uploading reports. Coverage reporting tools for some languages, gcov for C++ for example, produce reports that include source code in the report data in order to apply report fixes. Codecov scrubs some source code out (and we plan to support this effort more) but may not find it all. These uploads, by default, are archived for 1 month. You may elect to prevent all uploads from archiving by disabling this feature. ``` ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 24, 2022, 6:58pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/13 "2022-05-24T18:58:18Z")
Isn’t a screenshot of having set up GH integration sufficient proof of ownership? How’d a random user without admin access allow or revoke the app permission? ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [May 24, 2022, 8:10pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/14 "2022-05-24T20:10:44Z")
@bruce-wayne I cannot confirm that the app permissions for the above org or user were revoked or not given the screenshots above. ---
**Author:** ![bruce-wayne](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/bruce-wayne/32/2392_2.png) [@bruce-wayne](https://community.codecov.com/u/bruce-wayne)\ **Post date:** [May 24, 2022, 8:57pm UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/15 "2022-05-24T20:57:05Z")
![Screen Shot 2022-05-24 at 1.50.19 PM](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/d/de99a599e1a5f9eaac3ce0f214f2b0ec47b9f7a5.jpeg) These should help. ![Screen Shot 2022-05-24 at 1.50.55 PM](https://canada1.discourse-cdn.com/flex029/uploads/codecov/original/2X/3/36f32fe7181532c7f22005c40072c847367da12e.jpeg) ---
**Author:** ![tom](https://yyz1.discourse-cdn.com/flex029/user_avatar/community.codecov.com/tom/32/8_2.png) [@tom](https://community.codecov.com/u/tom)\ **Post date:** [August 23, 2023, 2:53am UTC](https://community.codecov.com/t/private-repos-shown-for-set-up/3595/16 "2023-08-23T02:53:47Z")
@bruce-wayne I never got a chance to get back to this post. We switched to a GitHub app over an Oauth app which should help have more granular [permissions](https://about.codecov.io/blog/codecov-is-updating-its-github-integration/). I don’t know if this was still an issue for you, but if so, let me know if I can help.