Authentication & Secrets
Hardcoded Credential
Also: secret in source code
A password, key or token written directly into source code or a config file that is committed.
In more detail
Version control keeps every past version, so a secret committed once is in the history even after a later commit removes it. The only reliable fix is to treat it as exposed and rotate it, then move the secret out of the code.