Sensitive parameters such as merchant numbers and keys should be placed only in configuration files and not written into business code, in order to protect information security.