Why should API keys never be hardcoded in `application.properties` committed to source control?

A committed secret is permanently in git history even if removed later, is visible to anyone with repo access, and if the repo is ever public or breached, the key can be used by anyone to rack up charges on your account. Keys belong in environment variables or a secrets manager (Vault, AWS Secrets Manager) injected at runtime, never in version-controlled config files.