While authorizing a new OAuth app for my GitHub account I noticed that the 'php' organization is one of the few does not have the OAuth "allowed application list" feature enabled that requires explicit approval by an organization owner before an OAuth app is allowed to access private resources within the organization (that includes write access to the repositories). While I trust the OAuth applications I approve for my repositories, I don't necessarily trust them with the PHP organization's resources.