What GitHub feature allows you to restrict which OAuth Apps can access your organization's data?
Select an answer to reveal the explanation.
Short Explanation and Infographic
OAuth App restrictions are your org's doorman for third-party apps. Enable restrictions and by default all OAuth apps are blocked from your org data — only apps you explicitly approve get access. Existing app authorizations are grandfathered in unless you revoke them.
Full explanation below image
Full Explanation
GitHub organizations can enable OAuth App access restrictions to control which third-party OAuth Apps can access organization resources. When enabled: (1) By default, all OAuth Apps are blocked from accessing organization data. (2) Organization members cannot authorize OAuth Apps to access org resources without owner approval. (3) Organization owners can approve or deny OAuth App access requests from members. (4) Previously authorized OAuth Apps that haven't been explicitly approved are restricted immediately or after a grace period. This protects against 'supply chain' attacks where a malicious OAuth App tricks users into granting it access to organization data. Note: GitHub Apps use a different permission model (installation-based) and are managed separately.