Why does the GitHub Power-Up require read-write access?
Our GitHub Power-Up requests the minimum viable scope necessary for it to work. We need those two scopes so that we can list all available repos (both public and private), as well as PRs, branches, issues, and commits in those repos.
The only instance in which the GitHub Power-Up ever writes back into GitHub is when attaching a PR, issue, or commit to a card with the GitHub button. Trello will make a comment on the attached item on GitHub with a link to the Trello card. This feature can be disabled in the GitHub Power-Up's settings menu (in which case we write nothing back to GitHub).