Writing a sensitive value like a password or API key straight into your source code instead of loading it from a separate, protected place. It's risky because the value then travels everywhere your code goes, including your version history and any shared repository.