Sensitive data on configuration managment How can I prevent some sensitive data (e.g. password for the SMTP module) from getting into my repo as part of the Configuration Management system?
From page 17 of the Drupal PCI Compliance Guide:


  Removing credentials from settings.php. One can include a settings.local.php file within settings.php to ensure that sensitive information is not distributed.


This is good advice and is what most people do.

If you have a lot of information you want to store securely, looking at the Encrypt module or even a Lockr integration might be advisable.