Instagram Third-Party Access Audit

I own the Instagram account in question and have written authorization to test it. The core objective is to run a legitimate penetration assessment that shows exactly how secure (or exposed) the profile is when it comes to third-party integrations. I’m most concerned with apps or services that can post or send messages on my behalf, so the engagement must concentrate on discovering, analyzing, and rating every connection with that privilege.

Your task is to:

• Enumerate all connected apps and services, mapping their granted scopes.
• Highlight any that are able to publish content, DM followers, or otherwise act as me.
• Flag data-exposure paths—tokens stored insecurely, excessive read-only scopes, or lingering OAuth approvals.
• Provide a clear remediation plan: which tokens to revoke, which settings to tighten, and best-practice recommendations to prevent future over-permissioning.

Please work with standard security tooling (OAuth token analysis, session hijack simulation, API inspection, phishing-resilience checks) and supply evidence for each finding—screenshots, request logs, or PoC scripts where relevant. A concise report (PDF or Markdown) that ranks risks by severity and includes step-by-step fixes will be the final deliverable.