A password or connection string secret is embedded as a literal in the source code.
Load secrets from a secrets manager, environment variable, or protected configuration store.