Rotated credentials, pruned OAuth grants, and read through a year of third-party app permissions I’d forgotten I’d approved. Half of them belonged to services that no longer exist.
Hygiene work is unglamorous and produces no artifact worth showing anyone. It only ever prevents things — which is exactly why it gets skipped until it doesn’t.