I do not want to sign in with my GitHub

[pllim]

Hello. I am one of the maintainers of astropy. We have received some private security vulnerability reports from developers trying to collect bounties that you offer (that is, we did not solicit these reports though they are not entirely unwelcome). For one of them, the reporter asked me to click on this link that requires me to provide your site with my GitHub account info and so on (using OAUTH). I am not comfortable with that. Is there an alternative? Thank you.

[adam-nygate]

Hi @pllim! Thanks for getting in touch :)

Generally speaking, we send a magic-link to the nominated email address in your repository's SECURITY.md file that authorizes you, and so you won't need to login via OAuth, if you'd prefer not to. If you could send me an email (adam@418sec.com) with the detail of which repository this refers to, I can take a look into this for you and get you a magic-link, if for some reason this didn't arrive your nominated security email addresses inbox.

Connected to this, I'd love to get some feedback on why you're apprehensive to sign in with GitHub. It would be great if we could find a way to improve this part of the user auth flow so as to make this simpler for future users/maintainers.