Comment by mikeryan

There’s an interesting question on service providers responsiblity who use Oauth for primary auth.

Should they reset all access to a company account if a domain transfers or becomes publicly available?