Secrets are the values that let software prove itself to other systems: database passwords, payment keys, cloud credentials, token signing keys and webhook signing secrets. Whoever holds one can act as your app.
In AI-built projects they leak in predictable ways: pasted into a chat prompt, hardcoded in a source file, committed in an env file, baked into frontend bundles, or printed in logs and error messages. Deleting the file later does not help, because git history and any public copy keep the value.
Keep secrets out of source code, load them from environment variables or a secrets manager on the server, and limit each to the minimum access it needs. Rotate them regularly, and rotate at once after any suspected exposure, because a stolen secret works until you replace it. Turn on secret scanning so leaks are caught early.