title: ActionMailer password security
body: <p>Am I crazy, or is it a bad idea to keep my SMTP username and password for ActionMailer in the actual (development/production) config file? It seems like I should store it an encrypted place, or at the very minimum, exclude it from my Mercurial pushes.</p>
  
  <p>Right now, I'm just removing the password from my source file before performing a push, but there's got to be a smarter way than the one I'm using. :)</p>
  
  <p>Perhaps I should store it in my database as another user (which is already stored with encrypted passwords) and fetch it programatically?</p>