If i include a properties file in my project that contains a database password, how do i stop someone from browsing the .jar file and accessing it.
Currently i have it hardcoded, but you can decompile and access it even with Obfuscation.
Is there a best method for handling sensitive data in app code?
Short answer: You can't
Longer answer:
Protecting a JAR file is not really possible if the attacker has access to the file system and hence the JAR file. You could encrypt the property file that contains the database password, but then you're facing the same issue again as to where store the encryption password.
In the end, having passwords stored in property files is not optimal for security. If possible, you should use a password safe with an API usable by your application. Cyberark or Vault (and many more that I don't know) are examples of such password safes.