Finding 1 ยท High risk, small effort
An integration user holds admin-level rights and signs in with a password.
- Framework: Identity and access
- Why it matters: A leaked password exposes every record; a rotation breaks three integrations
- Fix: One External Client App per system, OAuth client credentials, minimum access

