We use read-only OAuth scope for FWD:Everyone. The security story is actually very good: - Tokens can only be used from servers that have been registered with

We use read-only OAuth scope for FWD:Everyone. The security story is actually very good: - Tokens can only be used from servers that have been registered with Google, so even if a startup has their OAuth tokens stolen the attacks can't really make requests on their behalf. - Tokens access has per user and per app rate limits that are configurable in the Google console. - With read-only OAuth access, there isn't really any value to attackers. E.g. if anyone tried to reset your bank passwords, it would be immediately obvious because they wouldn't be able to delete the password reset emails. I'm currently (i.e. today) writing a Gmail Add-on that only requires read-only access to the currently open thread rather than requiring it for your entire inbox. (Basically read-only access is granted when you click the icon to activate the add-on within the currently open thread.) This is something that's become possible in the last six months and is probably a slight improvement from a security perspective, but even the baseline level is pretty solid. The tech industry has yet to see any large OAuth-related security breaches, and frankly we may just never see that given the combination of the good security story and the limited value to attackers.