Connection strings may include database usernames and passwords.
API keys & secrets can grant access to external services (payment providers, email gateways, cloud APIs).
Misconfigurations can expose secrets in logs or error messages.
If these values are compromised, attackers can steal or manipulate data, escalate privileges, or abuse external services.