Secrets should not be in source code and in version control because of two reasons:
External threat: An attacker can exploit a vulnerability to get access to files/source of your website/application. For example by exploiting directory traversal or arbitrary file download vulnerability. Such an attack should not lead to leaking of secrets.
Internal threat: A developer maliciously copying/distributing source code. Understandably, there needs to be a small subset of people who need to know these secrets, what we are trying to avoid here is to have the secrets visible to all developers in the organization who have access to the version control system.
Environment variables is one usual solution. However, if the build scripts are also versioned then we are just changing the location of secrets from source code to the respective hudson/jenkins/capistrano script.
What are the best practices to keep passwords out of source code?