Salesforce does offer granular controls for admins to restrict or allow connected apps, but in a lot of older instances this is not restricted. Partly this is d

Salesforce does offer granular controls for admins to restrict or allow connected apps, but in a lot of older instances this is not restricted. Partly this is due to lack of awareness of the threat vector, or sometimes because no one cares enough. In the current release I think Salesforce is locking things down by default to avoid this. https://help.salesforce.com/s/articleView?id=release-notes.rn_security_connected_app_restrictions.htm&release=256&type=5 https://help.salesforce.com/s/articleView?id=release-notes.r...