u/Sebasnio-Weakness690

We found a marketing tool last month that had been storing employee credentials in plaintext for over a year, completely outside any security review. Nobody thought to flag it because it wasn't seen as a "real" application, just some tool a team signed up for on their own.

Curious what other people have found when they've actually gone looking for this stuff, and whether it's usually this bad or if we got unlucky.