---
title: "Discussion on \"The Password Was Inside the App You Downloaded\" | Hashnode"
description: "Discussion on \"The Password Was Inside the App You Downloaded\". Wyndham's Android app carried the keys to its own customer database — and the company can't say whether anyone else used them first."
url: "https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The Password Was Inside the App You Downloaded](https://nulltrace.hashnode.dev/the-password-was-inside-the-app-you-downloaded?utm_source=hashnode&utm_medium=feed)

Wyndham's Android app carried the keys to its own customer database — and the company can't say whether anyone else used them first.

8h ago · 5 min read · nulltrace.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#data-breach](https://hashnode.com/tag/data-breach)
-   [#app-security](https://hashnode.com/tag/app-security)
-   [#hardcoded-credentials](https://hashnode.com/tag/hardcoded-credentials)
-   [#hotel-security](https://hashnode.com/tag/hotel-security)

## Written by

[Cyber Knight](https://hashnode.com/@cyberknight2479)

@cyberknight2479

  
[View profile](https://hashnode.com/@cyberknight2479)

## Responses 1

Markdown supported · ⌘↵ to post

[Damiano Bianda](https://hashnode.com/@damianobianda)

[5h ago](https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d/comment/6af2f0693d15350fe6cda0a2)

The part that stays with me is that the company can't say whether anyone used the credentials first. A password inside a shipped app is about as findable as secrets get, so 'no evidence of misuse' mostly means no logging, not no abuse. Did Wyndham say whether it rotated everything the app could reach, or just the one database?