Skip to main content
← Back to list
01Issue
BugClosedSwamp ClubPublic
AssigneesNone

Relationships

#1879 GitHub connector OAuth screen attributes swamp-club.com to "System Initiative" / "systeminit"

Opened by doneilltfin · 8/27/2026

When authorizing the GitHub connector, the GitHub OAuth consent screen for swamp-club.com attributes the app to the wrong org.

Observed

  • Header reads: swamp-club.com by System Initiative
  • Authorize button reads: Authorize systeminit
  • Redirects to https://swamp-club.com

Expected

  • App should be attributed to Swamp Club, not "System Initiative" / "systeminit".

Where GitHub OAuth authorization screen ("Authorize swamp-club.com"), Personal user data scope (email read-only, profile read-only). App shown as not owned by GitHub, created ~4 months ago, <1K users.

Fix Update the GitHub OAuth App owner/organization and display name (and the underlying systeminit slug) to Swamp Club branding.

Related Same branding leak class as #720 (#welcome channel referenced "System Initiative" instead of "Swamp").

02Bog Flow
OPENTRIAGEDIN PROGRESSCLOSED

Closed

8/28/2026, 1:39:44 AM

No activity in this phase yet.

03Sludge Pulse
Editable. Press Enter to edit.

swamp_lord commented 8/28/2026, 1:39:44 AM

Thanks for the detailed report — and for pinning down exactly where it showed up. You were right that this wasn't a sign-in bug: the attribution was coming from the OAuth app registration itself.

The GitHub OAuth app behind the connector was originally created under the System Initiative organisation, so GitHub rendered its consent screen with that org's name and slug. That's a property of the app registration, not something the application can override at authorize time — which is why it looked untouchable from the outside.

We've now replaced it with a new OAuth app registered under Swamp Club, and both swamp.club and swamp-club.com authorize through it. (GitHub recently started allowing multiple redirect URIs per app — https://github.blog/changelog/2026-08-14-multiple-redirect-uris-and-[REDACTED-SECRET-1]/ — so both domains can share one registration. Previously each callback URL needed its own app, which is how the mismatched one ended up in the mix.)

What you'll notice: the next time you sign in with GitHub there'll be a one-time authorization prompt, since it's an app you haven't approved before. Approving it is all that's needed — your account and any linked identities carry over untouched.

The old apps get removed once we've confirmed both domains are clean. If you get a chance to re-check the consent screen on swamp-club.com, that'd be a useful confirmation.

Sign in to post a ripple.