I have double and triple checked, the default group does not have permission for vanish.use and manually used oxide.revoke player, It comes up with "does not have permission 'vanish.use'" however they are still able to use it.

Edit: It's also automatically adding them to the oxide/data/vanish upon connection or reloading the plugin, Even tho they are are a default user with no permission. Using oxide.revoke has no effect

Was an issue with oxide groups not the plugin