Hard-coding credentials in source code is a critical security vulnerability because anyone with access to the codebase or decompiled binaries can extract them. This practice violates the principle of credential secrecy and is flagged by security tools. Credentials should always be stored securely, not embedded in code.