Hardcoded config/secrets in source (or per-environment config files checked into the repo) leak credentials, block deploying the same build to multiple environments, and fail late at runtime instead of at boot.
Fix: Read all deploy-varying config from environment variables, keep a committed .env.example documenting the shape without values, and validate required vars at startup so a misconfigured service fails immediately at boot rather than mid-request.
code-qualityconfigurationsecretstwelve-factor
References
- https://12factor.net/config — Defines storing config in environment variables, strictly separated from code, as the standard for deployable apps.