The Problem With 'Trust but Verify' Is That We Don’t Verify

Summary: The article argues that SaaS environments run on implicit trust: OAuth tokens and API keys issued to third-party apps often never expire or get rotated, and integrations routinely receive broader permissions than they need. It cites the early-2023 Slack and CircleCI token thefts, the 2025 Salesloft/Drift breach in which stolen OAuth tokens for a Salesforce integration were used as skeleton keys, and ShinyHunters' mid-2025 phishing and vishing campaigns that obtained OAuth access to companies' SaaS accounts, including at Google and Workday.
Why it matters: SSO and MFA guard the front door, but a single token in the wrong hands bypasses both - as Slack and CircleCI found in 2023 and Salesloft/Drift customers found in 2025. If your last review of connected apps and their scopes was at the initial 'Allow' click, you have no idea what those tokens are doing today.

Read the original at The Hacker News ↗