How does authorization work in the vk.com API?

Question

In contact with

Hello. I think it would be more correct to ask this question on a Russian-language resource. Namely: in the vk.com api, any application can access user data through an access_token. That is, 3rd party applications like k...mobile can essentially access information they shouldn't have access to. Is it safe or am I missing something?

Answer 1

1. the user installs the application
   This is considered safe.
   If VK suspects the malicious activity of the application, they "turn it off" - all permissions issued by users to this application are canceled at once, it will no longer be able to fulfill requests to the VK API.