[vineyardmike]

> Credentials in source code, are the equivalent of password on post it notes ;)

While not the best security, post it notes are immune to hacking and really hard to leak without a home intrusion.

Credentials in source that won't be shared is a pretty efficient hack. Often it happens by mistake - eg. when you hard-code that credential into a bash script during testing when you're trying to curl a new API and then push it by mistake after a coworker asks for you to share your progress on a new branch for review.