Detects when a GitHub Organization disables OAuth App access restrictions by observing the audit log event org.disable_oauth_app_restrictions. Disabling restrictions allows any OAuth App that a member authorizes to access organization data without owner review, creating a path for token-based persistence and data exfiltration after a compromise. The rule is high severity because it directly weakens third-party access controls and can enable attacker-controlled apps to gain broad access. The detection is anchored on the GitHub audit log event and surfaces related fields such as user.name, github.org, github.actor_ip, github.hashed_token, github.programmatic_access_type, and github.user_agent to aid investigation. MITRE ATT&CK mappings include Defense Evasion (TA0005) with Domain or Tenant Policy Modification (T1484) and the subtechnique Impair Defenses / Disable or Modify Tools (T1562.001), reflecting the tactic of weakening security controls to maintain access. Investigation should correlate with subsequent oauth_authorization.create events, other high‑impact changes (owner/member modifications, PAT grants, SSO/SAML/2FA changes), and anomal authentication contexts (unfamiliar IPs, unusual user agents, or token-based programmatic access). False positives may occur when restrictions are temporarily disabled for legitimate onboarding; such actions should be followed by re-enabling restrictions and explicit app approvals. Remediation involves re-enabling restrictions, revoking new authorizations, rotating tokens/credentials, reviewing related audit logs, and tightening change controls to alert on future modifications to OAuth App restrictions.