🤖 When you connect a service in Integrations — GitHub, DNSimple, and
friends — you now choose what that connection is allowed to do: **read
only** (the default) or **read & write**. The choice is sealed into your
connection with the same lock only you hold, so the server never learns it,
and it's a hard ceiling: a read-only connection can never be asked to write,
by a bot or anyone else. You can change a connection's access any time from
Integrations.