A mobile app was leaking personally identifiable information (PII) without anyone knowing. The source? A third-party analytics library. No one on the development team had changed anything. The configuration was untouched. But the library was quietly sending user credentials to its backend dashboard, where they were stored and exposed.