Hard-coded credentials in source code are visible to anyone with access to the codebase, including insiders after deployment and attackers if the code is leaked. This applies to both internal and external applications. Secure practice requires using environment variables, secure vaults, or configuration management systems.