Secrets in code
When sensitive data — API keys, passwords, tokens, private keys — is checked into the source code or version history. A constant and serious problem: once in the git history the secret stays there forever, even if "removed" in a later commit.
The problem: a developer puts a key directly in the code "temporarily" and forgets it, or a config file with secrets is committed by mistake. When the repo is shared, becomes public, or leaks, the secret is exposed. Worst: a git rm doesn't remove it from the history — it remains in earlier commits and can be dug out. Bots scan GitHub in real time for keys and exploit them within minutes. Defense: secret scanning (gitleaks, trufflehog, GitHub's own scanners) in CI and pre-commit hooks to catch it before it's committed, rotate immediately any secret that leaked (assume it's compromised), use a secrets manager instead of code, and clean the history (BFG/git filter-repo) on a leak. One of the most common ways secrets are compromised. Related to hardcoded credentials and secret rotation.