Subject: Salesforce API Access Change for Connected Apps
You are receiving this communication because we have identified you as a system administrator of an organization with users that currently leverage a subset of connected apps and have profiles with the "API Enabled" permission turned off
We regularly review Salesforce architecture, and as part of this routine review, we identified a subset of connected apps* that were not following the "API Enabled" user permission for the Enterprise, Unlimited, and Performance Editions.
This behavior resulted in users being granted API access regardless of profile settings, creating the opportunity for them to have broader access than explicitly granted. We have no evidence that customers were negatively impacted by this behavior.
Seems like a pretty big security hole and some really bad code on Salesforce's part; am I missing something? Why would they send out the alert before fixing the issue?