That universal OTP code someone added for staging is the one credential in your system that never expires, doesn't rotate, and stays out of your audit log.
If it has to exist, it should expire on its own, it should make noise in the logs on every use, and the app should refuse to start in prod while it's set. Worth knowing who on your team owns that check. https://shipmindlabs.com/c/dce0b383