Documentation
¶
Overview ¶
Command driftstop re-enacts the Salesloft–Drift / UNC6395 OAuth-token theft (Aug 2025, ~700 orgs) and shows the token that survives it. The attacker stole the Drift integration's OAuth tokens, used them against Salesforce to run bulk SOQL exports, harvested secrets (AWS keys, Snowflake creds) embedded in support cases, and pivoted onward — dwelling ~10 days because the tokens were broad, long-lived, and revocable only org-wide.
We replay the SAME theft twice. First with a broad OAuth service-account token (what was actually stolen): bulk-export and secret-harvest both succeed. Then with a Legant on-behalf-of token — audience-scoped to the CRM, no bulk-export tool, no access to the secret-bearing records, a 15-minute TTL, and a business-hours window — every move the attacker makes is refused OFFLINE at the resource server, and one signed-feed entry kills it for good.
No database, no Docker:
go run ./examples/driftstop # or make demo-driftstop
NOTE (honest): a stolen token is still presented; Legant doesn't stop the theft. It collapses the blast radius — the constrained token can't bulk-export, can't read the secret-bearing records, can't pivot audiences, expires in minutes instead of days, and is revocable in one signed-feed entry rather than org-wide.
Source Files