Public OAuth credentials on Toolforge tools are an unfortunately common issue. Whilst the envvars service will hopefully make those less of an issue on the long term, I don't see the number of misconfigured tools decreasing on the short term. I wonder if there should be a standard process to follow especially in cases where the maintainer does not respond. Ssomething like this would be reasonable in my mind:

• Add tool maintainers to the Phabricator task, and send an email to them
• If the grant has any sensitive rights (which I believe is a MW defined term these days), revoke the consumer token immediately
• If the maintainers do not respond within a reasonable timeframe (say, two weeks), revoke the consumer
• If the issue goes unfixed within a slightly longer timeframe (say a month or two) revoke the consumer