Klue's Salesforce and Gong Integrations Are Back. The Security Fine Print Is the Real News.

Klue’s integrations with Salesforce and Gong — pulled from both partner marketplaces after an earlier security incident — are back, with the Klue Compete App relisted in Salesforce’s AgentExchange and Klue’s Gong Collective listing restored (its HubSpot listing was never affected). The restoration followed what Klue describes as CrowdStrike’s independent review of its incident response, and CEO Jason Smith detailed the hardening required for reinstatement: all outbound Klue traffic now routes through static egress IPs explicitly allow-listed by Salesforce and Gong, PKCE is mandatory platform-wide for every OAuth flow, and token lifecycle policies have been tightened. Klue also says it eliminated standing GitHub Personal Access Tokens in favor of short-lived credentials and stood up centralized monitoring, with the remediation work carried out over several weeks before this announcement.

The specific fixes Klue is publicizing — no standing credentials, scoped and short-lived access instead — are the same principle enterprise AI vendors are now building into agent identity by default, not retrofitting after an incident. Anthropic’s access-control model for Claude Tag gives an agent its own scoped identity per channel rather than inheriting a logged-in user’s credentials, with admins defining baseline connector and repo access at the workspace level and future work aimed at just-in-time credential grants for one-off sensitive actions — short-lived, purpose-scoped access as the starting design, not the post-incident patch.

For sales and competitive-intelligence teams whose battlecards and deal intelligence depend on Klue’s Salesforce and Gong connections, the integrations working again is the immediate news. The more durable one is the checklist Klue just made public: egress IP allow-listing, mandatory PKCE, no standing tokens. Any vendor asking for marketplace-level access to your CRM and call data should be able to answer the same three questions Klue’s incident forced it to answer for itself — and increasingly, buyers should be asking before an incident, not after.