A password, API key, secret, or token assigned a literal string constant embeds credentials in the app binary.
Load secrets from the Android Keystore, encrypted storage, or a secure server-side configuration.