Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain

Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain highlights how OAuth tokens and other credentials have become high‑value targets in cloud‑based integrations, with a recent high‑severity scenario involving a third‑party application linked to Salesforce. According to Unit 42, Palo Alto Networks, a threat actor, UNC6395, stole an OAuth token from the Salesloft Drift integration, bypassing MFA and enabling access to hundreds of Salesforce instances.

The piece also cites historic breaches: in 2022, GitHub disclosed that OAuth tokens issued to Heroku and Travis CI integrations were compromised; in 2023, CircleCI reported exfiltration of tokens and secrets stored unencrypted; and in 2024, the Internet Archive breach saw GitLab tokens valid for 22 months, resulting in the exfiltration of 7 TB of data.

It then offers three pillars of OAuth token security—posture management, secure storage, and runtime monitoring—with practical steps such as inventorying tokens, revoking dormant integrations, encrypting stored tokens, centralised logging, and rapid revocation when misuse is detected. The message underscores that token lifecycles, rotation, and ongoing monitoring are essential to reduce supply‑chain risk as organisations increasingly rely on third‑party integrations.