For the desktop version we implemented GitHub OAuth using the device flow, so you can hold credentials on your local device. The tradeoff is there's no granular control of permissions, it has whatever access your account has.

On bloop cloud we use the GitHub App permission system which is more granular and only request read access.