A password, API key, or token is assigned a hardcoded string literal.
Load secrets from the Keychain or a secure configuration service, never from source.