Hard-coding credentials (passwords, API keys, secrets) in source code is never secure regardless of application type. Credentials embedded in code can be exposed through version control, code sharing, or reverse engineering. Options C and D are dangerously incorrect - internal apps often become external or face insider threats. Secure practice requires using environment variables, secret management services, or encrypted configuration files.