Credential re-use. Someone uses the same password on github as they did for photoshop and suddenly a breach in one place leads to source access. And private s

Credential re-use. Someone uses the same password on github as they did for photoshop and suddenly a breach in one place leads to source access. And private source code is typically full of credentials or makes it very easy to find poorly secured admin functions, if it doesn't contain copies of data itself. Data hygiene, good security around credential re-use and 2fa, not putting in backdoors all lead to leaks. Or more mundane unsecured direct object references which catches out even large companies sometimes.