The persistence move is the part to underline: adding client secrets to two other trusted apps means disabling the seven ConnectWise identities is not cleanup, it is step one. "Review every consented application" is really "re-attest grants you made years ago under a different threat model". For a team that finds a rogue secret, is revoke-first always right, or does keeping it alive for forensics ever win?
Abhinav Sharma
Founder of Impact Gate. See who breaks before you change an API.
The persistence move is the part to underline: adding client secrets to two other trusted apps means disabling the seven ConnectWise identities is not cleanup, it is step one. "Review every consented application" is really "re-attest grants you made years ago under a different threat model". For a team that finds a rogue secret, is revoke-first always right, or does keeping it alive for forensics ever win?