I like the less obvious kinds, some objects in AD with SACLs that will trigger when AD enumeration is performed. A Kerberoastable account with a weak password. Access keys burried in the wiki or better, in the wiki versioning history.