Only the access needed to dispatch a review.

• Repository metadataRead

  Identify selected repositories, default branches, and repository state.

• ContentsRead

  Keep a mirror of the repository’s history, to see who wrote the code a pull request changes.

• Pull requestsWrite

  Read pull request state and request reviewers. Diff Dispatch never merges or changes code.

• Organization membersRead

  Find eligible reviewers and connect GitHub identities to Slack members.

• installation
• installation_repositories
• push
• pull_request
• pull_request_review
• repository
• membership

Delivery IDs are stored for deduplication; duplicate and out-of-order webhooks do not create duplicate assignments.

• chat:writeim:write

  Send assignment messages, working-time reminders, and an optional digest.

• users:readusers:read.email

  Match Slack identities to GitHub members using verified email, with admin correction and self-linking where needed.

• channels:read

  Let an administrator select a digest destination. The bot must be invited to that channel; Diff Dispatch does not request workspace-wide posting access.

• commands

  Add the /diffdispatch-link command, which members use to link their Slack account to their Diff Dispatch account.

• Merge, approve, or close a pull request
• Push commits or change code
• Review code in place of your team
• Post to channels it wasn’t invited to

Questions from a security review? hello@diffdispatch.com · Data policy