I still think about how Instagram's entire kingdom (source code, SSL certs, AWS credentials) was left wide open because someone deployed an open source admin tool on a single server and never changed the default hardcoded secret key:

https://news.ycombinator.com/item?id=10754194

https://web.archive.org/web/20151217205414/http://www.exfilt...