AI Code Editors Keep Hardcoding Secrets Into Generated Code

AI coding assistants like Cursor, Copilot, and Claude Code frequently embed API keys and tokens directly into source code because their training data includes tutorials that do the same. A developer nearly committed a live Stripe key to a public repo after Cursor generated working code with a hardcoded secret. The fix is to always use environment variables and scan for secrets before every commit.