Keeping default credentials on your self-hosted services is the biggest mistake you can make ...