TL;DR AI editors paste real-looking API keys, JWT secrets, and DB passwords straight into your source code because their training data is full of tutorials that do exactly that. A hardcoded secret in a committed file is a live credential the moment it hits your git history, and rotating it later doesn't undo the exposure. The fix is to read every secret from an environment variable and run a secrets scanner before each commit, so the key never lands in a tracked file. I asked Curs...