The ProtectionLevel property of the ConnectionManager will change what and ifsensitive information is saved.
Personally I do not like saving sensitive information in a package, I much prefer using configurations. This allows you to keep such information externally, and just by changing the configuartion information between environments you can easily manage this. This mechanism is obviously great for when moving packages between test and production environments for example, but it scales right down to the developer's desktop, so you use the same mechanism throughout.