Stolen OAuth Tokens Outlive Password Resets: Hardening Session Material in SaaS Estates

Why stolen OAuth refresh tokens survive password resets, and the binding, rotation and detection controls that actually contain them.