It has some ancient history as a morse code distress signal: https://regulatorylibrary.caa.co.uk/923-2012/Content/Regs/03...

And it shows up in some old BSD code: https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/

But... I think repeated letters are just easier to type than any other string, and since X looks like the classic "marks the spot" logo, it's what people jump to.

I always thought it was from Java, but that's probably a personal bias; I am sure it was used long before Java was a thing. I did find this though (archived from 1999):

https://www.oracle.com/java/technologies/javase/codeconventi...

Unclear, but we do have https://www.catb.org/jargon/html/X/XXX.html

> Some hackers liken ‘XXX’ to the notional heavy-porn movie rating.

This seems plausible given the older culture ("this is metaphorically dirty, and therefore like porn", insert puerile snickering) and I can recall old jokes about "searching for" these markings. But I think it's also just about it visually standing out - the X character filling the terminal display cell with sharp lines.

Amsterdam.