Scope sprawl is the accumulation of excessive permissions across identities, applications, and tokens that exceed what is actually needed. It often results from developer shortcuts, poor documentation, and deadline pressure rather than malicious intent. Real-world examples include over-permissioned GitHub Actions tokens exploited in the tj-actions supply chain attack, long-lived API keys exposed in the Snowflake breach, and broadly scoped OAuth tokens abused in the Salesloft/Drift incident. Mitigation strategies include enforcing least privilege consistently, implementing fine-grained authorization with scopes and claims, using runtime access control tools like OPA or Cedar, and issuing short-lived, purpose-bound credentials.
Table of contents
So What Is Scope Sprawl, Exactly?Real-World ExamplesThe Scope Sprawl Defense ToolkitPermissions Are a Promise, Not a Default196 Impressions