Totally understand, but you're asking for the keys for the kingdom, without any data disclosure or privacy policy. Even if you switch to fine-grain permissions, the lack of any "and here are our commitments to handling or accessing your data" is (and should be) a show-stopper for anyone trying this out.

In case people aren't reading, here's the c+v of what Conductor gets access to currently:

--

This application will be able to read and write all public and private repository data. This includes the following:

    Code
    Issues
    Pull requests
    Wikis
    *Settings*
    *Webhooks and services*
    *Deploy keys*
    *Collaboration invites*

Note: In addition to repository related resources, the repo scope also grants access to manage organization attributes and organization-owned resources including projects, invitations, team memberships and webhooks. This scope also grants the ability to manage projects owned by users.