Yeah I don't know much about APP. As far as I know, no one does; there doesn't seem to be any information at all about what OAuth scopes (if any) are allowed.

Yeah I don't know much about APP. As far as I know, no one does; there doesn't seem to be any information at all about what OAuth scopes (if any) are allowed. In general though I think we'd be better off with Google just adding more restrictive OAuth scopes and improving their logging functionality so that users can see how apps are using their data. I'm clearly biased since my app is built on Gmail OAuth, but I generally just think that for whatever issues OAuth has, pushing people toward browser extensions or IMAP is a step in the wrong direction.