fellow dev thought he was being clever, hiding his private ssh keys inside image files on a public web server...

I can just hope it wasn't in the exif...

Well actually, once I sent a private key via email during a transfer masked as an image of my cat, you took the value of every fourth pixel and passed that through a specific processor which I won't name and extracted the key...