A password, secret, or API key assigned as a string literal exposes credentials in source.
Load secrets from environment variables or a secrets manager, never from source code.