In terms of user facing, https://github.com/onefinestay/cinch/issues/8 should prevent users from seeing pull requests from repos they have no access to. Do you think we need another authorisation layer?