Company Audits External Tools and Finds 43 Services

Following a round of secrets rotation and document reconnaissance, a vendor security breach headline prompted a critical question: who outside this building can read our data right now? The answer revealed forty-three external services holding standing access to company words, files, code, or customers. While most services were recognized, one turned out to be a free CRM trial from 2024 that had been continuously syncing contacts for two full years.

OAuth grants represent a supply chain we sign ourselves. Every grant functions as a key handed over to another company, tied directly to their security practices, employees, future acquirers, and their worst day. When a vendor suffers a data breach, attackers do not require your password because the vendor's grant handles the rest.

The inventory process began by checking every application installed on the organization via the GitHub API, followed by human-audited pages in Slack and Google Workspace settings. It also covered browser extensions logged into company accounts, payment processors, DNS records, monitoring dashboards, and registrars. An effective inventory requires five key columns: vendor, surface, scopes, data reach, and funeral plan, because you cannot revoke what you have never documented.

One practical defense strategy involves replacing standing read access with a monthly batch export. For example, database event records can be dumped and compressed into a gzip file for a one-way upload, ensuring that a connection never left open cannot leak data. Furthermore, downgrading vendor permissions is often frictionless since most providers fail to notice, indicating how little they actually required those broad scopes.