Sensitive data on configuration managment
From page 17 of the Drupal PCI Compliance Guide:


  Removing credentials from settings.php. One can include a settings.local.php file within settings.php to ensure that sensitive information is not distributed.


This is good advice and is what most people do.

If you have a lot of information you want to store securely, looking at the Encrypt module or even a Lockr integration might be advisable.