A public email is required for security reason. Considering this scenario:

1. An internal account "robin" exists in OneDev with administration permission
2. OneDev is configured to accept login via GitHub SSO
3. A hacker creates an account name "robin" at GitHub, and logins via GitHub SSO. At this point, OneDev finds that the account "robin" already exists, and it ensures that GitHub account has same email address as internal account "robin" before allowing account access.

I understand the need for the email for a user. However, having your email public anywhere is not a good idea nowadays. It's like asking for more spam and inviting scammers. Therefore, I have my email private and I think more and more people will be hiding their emails.

I just wonder if the 1dev can ask github to access user's email if it is set to private? This way user can hide his email from public and 1dev can check user's email during authorization time.

State changed as code fixing the issue is committed (b2fecfc8)

State changed as build #4496 is successful