Hi

We recently did our first deployment to prod and realised that all the custom profiles were somehow given access to our new objects and app in the package. The package only has permission set meta data nothing to do with profiles. Can anyone explain how this could have happened please?

appreciate some help