He didn't ask the application though. He changed the application or used information in the source code in a way that the shop didn't intend. So B is clearly no

He didn't ask the application though. He changed the application or used information in the source code in a way that the shop didn't intend. So B is clearly not the case. But even just assuming that the fact that the app was using a key means that he can try to access other things with it is a dangerous precedent. Can I access your OnlyFans if you give me the password to your Netflix account and you use the same password for both? Can I access the company database directly if the app connects to it? There could be all sorts of confidential info on that server, perhaps the gossip of the customer service people about you or info about other customers.