Assigning a literal password, secret key, or API key in source code exposes credentials.
Load secrets from environment variables or Rails encrypted credentials.