TL;DR
AI editors paste real-looking API keys, JWT secrets, and DB passwords straight into your source code because their training data is full of tutorials that do exactly that.
A hardcoded secret in a committed file is a live credential the moment it hits your git history, and rotating it later doesn't undo the exposure.
The fix is to read every secret from an environment variable and run a secrets scanner before each commit, so the key never lands in a tracked file.
I asked Cursor to wire up Stripe in a side project last week. It gave me working checkout code in about ten seconds. It also gave me this on line 3:
