Every engineering team accumulates a shadow inventory nobody deliberately built. A browser extension a designer installed in 2023. A scheduling SaaS tool signed up with a corporate Google account and forgotten. A npm package pulled in three transitive layers deep to format a date. Individually, each addition solved a real problem. Collectively, they form a supply-chain surface far wider than anything on the architecture diagram — and most of it is undocumented.
Sprawl is a default state, not a failure
Nobody decides to let the dependency footprint balloon; it happens through a thousand reasonable choices. A developer needs a feature by Friday and reaches for a library. A team adopts a point tool for a single workflow. A contractor connects a third-party app to the CRM to sync leads and never disconnects it after the engagement ends. Each step is locally rational and globally invisible.
The result is that the systems your product actually depends on are not the ones in your repository. They include the packages those packages import, the SaaS platforms holding slices of your data, the integrations granted standing access to your identity provider, and the extensions running inside every browser your staff use. When one of them is compromised or abandoned upstream, the blast radius reaches you regardless of whether you remember adopting it.
You cannot secure what you have never listed
The first move is boring and unavoidable: build an inventory. In the software supply-chain world this crystallizes as an SBOM, a software bill of materials — a machine-readable manifest of every component, library, and version that ships inside an application. Generating one turns a vague sense of “we use a lot of stuff” into an enumerable list you can actually query when the next widely-exploited library hits the news.
Extend the same discipline past your codebase. Pull the list of OAuth applications authorized against your Google Workspace or Microsoft tenant. Export the integrations wired into your CRM, your CI pipeline, and your chat platform. Most teams running this exercise for the first time are unsettled by the length of the result — and by how many entries nobody can explain.
OAuth scope creep is the quiet risk
The integrations deserve special scrutiny because of how their permissions work. When you connect a third-party app through OAuth — the “sign in with” and “allow access to” flow — you grant it a set of scopes, the specific permissions defining what it can read or change. A tool that only needed to read calendar availability may have been handed the ability to send mail as your users, because the broad scope was the path of least resistance at setup.
Those grants persist. They survive the departure of the employee who created them, the end of the project that needed them, and the sunset of the vendor that issued them. A token quietly holding write access to your mailbox is a live credential whether or not the integration is still in use. Auditing scopes — and revoking the ones that outstrip what the tool genuinely requires — closes a category of exposure that no firewall touches.
Offboard, consolidate, repeat
Once you can see the sprawl, prune it. Revoke OAuth grants for anything unrecognized or unused. Remove browser extensions that are not actively earning their place, since each one runs with deep access to whatever the browser sees. Delete the abandoned SaaS accounts still holding fragments of company data behind logins nobody rotates.
Then look for overlap. Sprawl frequently means paying three vendors for capabilities one platform covers, each with its own attack surface, its own access token, and its own breach to worry about. Collapsing redundant tools shrinks both the security surface and the invoice. For a small team without the bandwidth to run this rationalization internally, bringing in an Orlando IT consulting firm to map the estate and recommend what to cut is often faster than fighting the backlog alone.
Treat this as a standing loop rather than a one-off cleanup. New dependencies arrive every sprint, so schedule a recurring review of packages, integrations, and grants the way you already schedule dependency upgrades. The dependency you forgot you had is only dangerous while it stays forgotten. Make forgetting harder, and the sprawl stops compounding.
Top comments (0)