Things that might be hardcoded are access keys and passwords to PII databases.
Which is bad practice for lots of reasons and, is that a HIPAA violation? Your code also has it then.
Hosting git externally might be an issue though.
Re:Ask HN: Who Wants to Be Fired?
by all_usernames on Thursday October 03, 2019 @04:33PM
(#21151862)
No. No no no no no.
Unless you have patient information hardcoded into the source code for god knows what reason...