what are the primary security risks when granting api access to third party extensions in our business crm