If you don't expect your source code to be made public and don't take care to keep secrets out of it, then you will be surprised when attackers have (for exampl

If you don't expect your source code to be made public and don't take care to keep secrets out of it, then you will be surprised when attackers have (for example) your cookie signing key. I know checking secrets into source code is already a bad practice, but accidental publication takes bad practice and makes it a security hole.