Can secrets leak when someone forks a Replit project?

Replit Secrets (environment variables) are not copied when someone forks a public Repl, so they are protected from direct exposure through forking. However, developers sometimes accidentally hardcode API keys, database credentials, or tokens directly in source files rather than using the Secrets tool. Public Repls have their entire source code visible to anyone, making hardcoded secrets trivially discoverable. Historical versions of files may also retain secrets that were later moved to environment variables. UNPWNED scans for exposed secrets and credentials in deployed applications to catch these common mistakes.