MCP configs are the new .env files. I scanned GitHub and found live database keys committed in public repos. If you use Claude Desktop, Claude Code, Cursor or Windsurf with external tools, you have an .mcp.json or claude_desktop_config.json file on your machine. It tells your editor which MCP servers to start, and each server entry can carry an env block. That env block is a secret store. And developers are pasting real keys into it — then committing the file. What I fo...