What risk arises when credentials are stored in public code repositories?

• A. They cannot be accessed by anyone
• B. They are encrypted automatically
• C. They may be downloaded by unauthorized users
• D. They are immune to exposure

Answer: (C)

Storing credentials in public code repositories creates exposure because anything in a publicly accessible repo can be downloaded by anyone with the link. Credentials like API keys, passwords, or tokens give access to services, so once they’re visible, attackers or opportunists can misuse them to access systems, steal data, or pivot into other parts of a network. The risk is amplified by the fact that secrets can linger in the repository history, backups, or forks, meaning removing them from the latest commit doesn’t automatically purge their earlier presence. The safe approach is to keep credentials out of code entirely, using secret management tools or environment variables, and to rotate and scan secrets regularly.