If I were to hard code some database login information in an Install Script custom action, can anyone get to those script custom actions (in setup.exe), and read them?
You can create properties in the Property Manager view, and you can list them in a MsiHiddenProperties property, but that only prevents their values from being logged in the log file. If you then edit the .msi file, you can still see the property values in the Property Manager.
