Thanks for pointing out the concern. Some permissions are not needed indeed, I'll change the twitter oauth settings. But my web app really doesn't do anything other than pulling in the basic user info though.