I got the same notification yesterday morning for my own open-source extension HabitLab ( https://habitlab.stanford.edu/ ) - same vague request for "you're not using the minimal set of permissions" without mentioning what permissions they want me to stop using (HabitLab is already using the minimal set of permissions for the features it implements - any removal of permissions would have to be done at the expense of reduced functionality). Emailing just results in them sending me a link to the policy. So this is definitely not an isolated case.