A password written into a test file gets committed to your repository, and then it stays in the Git history even after someone deletes the line. This happens often, and it is not carelessness. It happens when nobody has shown you where else to put it.
This lecture is where else to put it.
The problem. Your suite has to run in more than one place. On your laptop the app is at localhost:3000. On the build server it is at a staging address. The login credentials differ too. Writing them into the test means editing tests to change environment, and it means secrets live in your repository forever.