How can I secure a custom module that contains sensitive data? I have made a custom module that contains my backup_migrate module profiles as described in this post.  Inside the array are my keys to log in to Amazon S3, which I certainly want to keep secret.

Putting such data in code inside a module immediately set off an alarm inside my head.  Is this a terrible thing to do from a security standpoint?  If so, why?
As long nobody is able to read this php files, there's no problem. If your host is set-up correctly and you are using the standard .htaccess file which comes with core, you should be fine.

An other question is who has access to your host and your source code. A good practice is to avoid any sensitive data inside git or any other source control system. A way to do this is to have a local.settings.php file a longside your settings.php. You can include it in your settings.php by ading this code at the end of the file:

if (file_exists(dirname(__FILE__) . '/local.settings.php')) {
  include(dirname(__FILE__) . '/local.settings.php');
}


Make sure this local.setings.php file is never visible to unauthorized people.

You can set any system variable in local.settings.php to your needs.