If you're going to store that info, use gpg (or perhaps gpgme) to encrypt it and keep the private key for decryption somewhere completely separate. Access to the source code shouldn't matter at all.