Instagram has announced some major revisions to its API policy including a new restriction that prohibits third-party apps from pulling in full feeds.

The media-sharing social network said in a post on its developer blog that it launched its first Instagram API in 2011 as the startup knew it wouldn’t be able to build all of the features its community would want. Several years in and with the backing of parent company Facebook, Instagram is in a much better position to build experiences in-house.

For starters, Instagram has updated its platform policy to explicitly list the use cases they will support moving forward. A full list of terms and conditions can be found by clicking here. What’s more, starting December 3, Instagram will institute a review process that’ll take a look at new and existing apps before full API access is granted. Existing apps will have until June 1, 2016, to submit and be approved.

Last but certainly not least, Instagram is launching a new Sandbox Mode that’ll give developers a place to privately build and test their apps using Instagram’s APIs during the app review process.

The changes come a week or so after it was revealed that a third-party app called Who Viewed Your Profile – InstaAgent was harvesting its users’ login credentials and sending them to a remote server in cleartext. Instagram didn’t specifically mention InstaAgent as the catalyst for change although given the timing and the nature of the new policies, it’s certainly implied.

As the saying goes, one bad egg spoils the bunch.