OAuth marketplace apps keep access after publishers vanish

An OhAuth audit of 2,890 public OAuth marketplace app listings (across marketplaces such as Google Workspace and GitHub) found many apps retain broad, persistent access to company assets — email, files, calendars, code, CI workflows, org settings and secrets — even after publishers vanish or apps appear unmaintained. Marketplace listings create a false sense of approval and the underlying OAuth grants often reach far beyond an app’s stated function, leaving organizations exposed to orphaned tokens and long-lived third‑party access. Recommended mitigations: inventory and periodically audit all