If you're concerned about keeping critical information in your Web.config file, then you should encrypt it -- or at least the parts that you're concerned about.

Creating a Web configuration INI file Application-specific configuration information has historically been stored in INI files, which are plain-text files that contain key/value data within sections.