Login credentials were left hardcoded in a tool, and no one spotted it for more than a year.
The tool, rolling out now to Windows Insiders, is accessible from the taskbar, but it opens and runs in your default browser.