I am on a team that is writing a .NET Core API to service a desktop application. This application used to manage its own database connection through an OracleConnection, and all the values used to connect to the database, including password, were hardcoded into the code (yes, I know).
Currently we are moving these values into a secure location, but my question is, what values do we need to hide? Obviously the password should be on this list. But should we also hide the host, service name, package names, port, service name, or user ID? Anything not on this list that should absolutely be hidden?