i am new to nodejs and express deployment...

i want to upload my files to my windows server machine, but i am afraid my source code can be retrieved using some url like http://myip:8080/app.js

Where should i put my files when i deploy my nodeJS app? Additional question: does anyone know where should i put my username and password for database instead of inside the source code?