Watchdog for unauthorized app access to your secrets

What to build

A lightweight OAuth app permissions auditor for solo developers and small teams that connects to Google Workspace, GitHub, Slack, and Notion, lists every third-party integration with account access, flags scopes touching secrets, credentials, or source code, and sends an alert when a new app is authorized or an existing grant's scope changes.

Individual developers have no easy way to see which third-party apps can read their secrets and source code across the SaaS tools they already use, and enterprise CASB/SSPM suites are built and priced for security teams, not solo builders.

Demand

Developers and small security teams who've been burned (or scared) by discovering an unrecognized integration with secret-scanning scopes want a simple always-on watchdog, not a six-figure enterprise platform; the HN thread shows this resonates well beyond the original poster.

• Hacker NewsNews

  "I never authorized an integration that scans my secrets" — 202 points, 154 comments on HN, indicating high engagement with the underlying concern about undisclosed OAuth app access to secrets.

• Signal report (unattributed user complaint)News

  User-reported incident describing a third-party app that gained or was granted OAuth scope access to secrets without clear consent or awareness.

• Opportunity brief (internal analysis)News

  Internal analysis identifying a gap between enterprise CASB/SSPM suites and individual or small-team needs for OAuth app visibility across Google Workspace, GitHub, Slack, and Notion.

Stack

• Google Workspace Admin SDK / OAuth token API
• GitHub REST API (OAuth Apps & installations endpoints)
• Slack API (apps.permissions)
• Notion API (integrations list)
• Supabase (auth + Postgres for storing scope snapshots)
• Resend or Postmark (email alerts on new/changed grants)

Solo + AI difficulty

The hard part is wiring up four different OAuth/app-permission APIs (each with inconsistent scope formats and admin-access requirements) and building a scope-risk classifier that's accurate enough to avoid alert fatigue; polling for diffs and sending alerts is comparatively easy. A focused solo builder using AI coding tools could ship a single-platform MVP (e.g. GitHub + Google Workspace only) in 2-3 weeks, with Slack/Notion as fast follow-ons.

Entry threshold

Mostly OAuth API integration and polling work, buildable solo in a few weeks using existing provider APIs (Google Workspace Admin SDK, GitHub App installations API, Slack app directory); main barrier is getting listed in app marketplaces and building trust for a tool that itself requests sensitive scopes.

Window

6-9 months

Where to find first users

• r/devops and r/netsec
• Hacker News Show HN launch
• Product Hunt launch
• Indie hacker / security Twitter and Bluesky communities

Competitors

• Nudge Security
• Astrix Security
• Valence Security
• Push Security

Counter-signals & risks

• The underlying complaint may stem from user error (forgetting a prior authorization) or misunderstanding legitimate app permissions rather than an actual unauthorized grant, which weakens the premise of a widespread, distinct problem.

• Major platforms (Google, GitHub, Slack, Notion) already provide native connected-apps audit pages, which could reduce willingness to pay for a third-party watchdog tool.

• There is no prior validated market pattern confirming demand for this specific lightweight, individual-focused product category, raising execution risk despite high engagement on the triggering signal.