The Hidden Risk of Using Shared OAuth Apps (Nylas, Unipile, etc.)

<p>so I've been building <a href="https://ship-safe.co" rel="noopener noreferrer">ShipSafe</a> — security scanner for AI-generated code — and a few weeks ago I got curious. like,

<p>A Vercel employee signed up for an AI tool. They clicked Allow All on the OAuth consent screen. Three weeks later, customer environment variables were sitting on a hacker's

<p>You click "Sign in with Google" on some app you've never used before. A popup flashes, you pick your account, and three seconds later the app knows your name and email. You

<p>This question keeps coming up:</p> <blockquote> <p>"My Gmail OAuth <code>client_id</code> got leaked. Is the system compromised?"</p> </blockquote> <p>Short answer: