TechCrunch reports Wyndham revoked an embedded credential following customer-data exposure.
The following technical context concerns mobile-app security in general. It is not a forensic assessment of the company’s systems.
A release package is available to its users
OWASP’s mobile security guidance explains that sensitive values bundled in an app can be recovered by people who download it. The problem extends beyond source-code strings: resources, configuration files, dependencies and leftover build material can also contain secrets.
OWASP recommends keeping static secrets behind a server-side service, using authenticated sessions with expiring tokens, and checking release artifacts and dependencies for accidental sensitive data. Its guidance also warns that obfuscation can raise the effort needed for extraction without preventing it.
For a development team, that makes the release package a useful review target alongside the source repository. A code review can miss a value introduced by a build step or bundled library. The practical question is what authority a recovered value would grant at the service that accepts it.
Reviewers should separate the ability to recover a credential from evidence about how it has been used. Demonstrating a weakness, confirming misuse and measuring affected records are different investigative tasks. Each needs its own evidence before a customer-impact claim is published.
