both, but mostly lazier. first time they rotate everything in a frenzy. second time it's 'eh, detection worked' while the creds are still hardcoded in the app config nobody audits.