OAuth marketplace apps keep access after publishers vanish
A security audit of Google Workspace and GitHub marketplaces reveals that thousands of OAuth apps retain access to sensitive user data even after publishers become inactive. Many of these apps request permissions that exceed their stated functionality, posing significant security risks.
Why it matters
The prevalence of 'zombie' apps with broad access to corporate data represents a major, under-addressed cybersecurity vulnerability for businesses.
OAuth marketplace apps keep access after publishers vanish Installing an app from the Google Workspace Marketplace or GitHub Marketplace can grant a third party access to company email, files, calendars, code repositories, CI workflows, organization settings, and secrets. Marketplace presence gives these apps the appearance of approval. The OAuth grants behind them often reach into business systems beyond the listed function.
The article presents findings from a security audit based on data, maintaining an objective tone.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in