Config and secrets
Also called Environment config, Deploy secrets
Whatever changes between deploys belongs outside the code: addresses, keys, passwords. The same artefact can then run anywhere, reading its settings from wherever it is running.
Hardcoded config means rebuilding to move, and a key in the repo is a key in every clone, every log and every agent's context. Deleting it later doesn't help, because the history remembers: rotate it.
Say it to your agent
“Move the API key and database URL out of the code and read them from the environment. Fail at boot with a clear message if one is missing. List the names in .env.example with no values. Then check the git history, and tell me if the old key was ever committed, because then it needs rotating.”