limit the permission to github.com in manifest.json