I wouldn't put any sensitive information in a fact, unless the only people with access to PuppetDB and your Servers are admins who already have access to this information. But even then I still wouldn't do it.
At this time I would say the best route would be something like hiera. -- You received this message because you are subscribed to the Google Groups "Puppet Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/puppet-users/f53cd860-f56b-4380-a94b-968f1abb144b%40googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
