How the hell do you even think “it’s fine, I’ll put this password in plain text” when literally building an app for a CREDIT UNION? Obviously it’s not acceptable to do that anywhere, but you would think they would think just a little bit harder about the decision when working with such sensitive data?

I wouldn’t be surprised if this is the result of “near shoring”/outsourcing technical work to foreign countries.