
But that's one big of a problem, right? To be able to do this, you need to persistently store the credentials to the Gmail account on the compromised server. So, before we turn ourselves into cowboys and log in to that Gmail account, because of course we can at least do the things that that API secret is able to do.