Hardcoded credentials in source code can be extracted by attackers.
Store secrets in environment variables or a secrets manager. Never hardcode credentials.