I've seen this so many times in self-rolled auditing kludges that it has become kind of a running joke. I'm now surprised if anyone does anything more sophistic

I've seen this so many times in self-rolled auditing kludges that it has become kind of a running joke. I'm now surprised if anyone does anything more sophisticated than sym encryption of master credentials used to guard secrets without using the same secret for both as a first pass. Embedded master passwords abound in most legacy OSS configurations.