TP: If you can validate that inbox rule was developed by an OAuth third-get together app with suspicious scopes sent from an unidentified source, then a real positive is indicated.FP: If you can ensure that app established an inbox rule to a different or particular external email account for legit reasons.You can use a url in bio Software, like Lat