---
title: "Comment by Damiano Bianda on \"The Password Was Inside the App You Downloaded\" | Hashnode"
description: "The part that stays with me is that the company can't say whether anyone used the credentials first. A password inside a shipped app is about as findable as sec"
url: "https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d/comment/6af2f0693d15350fe6cda0a2"
---

[Discussion](https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d)

Comment [The Password Was Inside the App You Downloaded](https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d)

[Damiano Bianda](https://hashnode.com/@damianobianda)

[5h ago](https://hashnode.com/posts/the-password-was-inside-the-app-you-downloaded/6af2c28b123b432f99a5aa2d/comment/6af2f0693d15350fe6cda0a2)

The part that stays with me is that the company can't say whether anyone used the credentials first. A password inside a shipped app is about as findable as secrets get, so 'no evidence of misuse' mostly means no logging, not no abuse. Did Wyndham say whether it rotated everything the app could reach, or just the one database?