MCP credential exposure puts API keys and access tokens at risk as hardcoded secrets remain in public GitHub configuration files.