Rotate the live tokens your vendors hold. The Hacker News reports Chainalysis exposed names, usernames, password hashes and live tokens for every user; Startup Fortune reports Deribit lost $28 million from a hot wallet; CISA lists a SonicWall SSLVPN flaw under active exploitation that bypasses SAML.
Rotation is the easy half: if you cannot say what each token was scoped to reach, you reset the clock. We review that scope on payment flows, and you probably want to know what yours can touch.