Login credentials were left hardcoded in a tool, and no one spotted it for more than a year.