A password, secret, or API key literal embedded in source is a leaked credential.
Load secrets from environment variables or a secrets manager, never from source.