If they have access to the application code then it's all over, since your application has to be able to decrypt the password back to plain text to use it. The

If they have access to the application code then it's all over, since your application has to be able to decrypt the password back to plain text to use it. The only way around this that I can see is just using a different method of authentication.