Sensitive data like API keys and passwords should never be hard-coded in the source code or stored in files that can be exposed. Instead, these should be stored in environment variables or managed through tools like AWS Secrets Manager or HashiCorp Vault. These tools not only securely store sensitive data but also provide access control and auditing features. In Python, libraries like python-dotenv can help load environment variables from a .env file during development.