How do you protect your PostGIS credentials when using QGIS 1.7?

Don't check "Save passwords" (and/or "Save username") in the connection - and QGIS will ask for credentials when it needs them.

It is possible to manually delete attributes from the project file such as the user & password attributes. In your example, you could use Find & Replace to delete every instance of "user='generaluser' password='gisv13wer'".

However, if you add another layer while QGIS is set to remember the credentials, the credentials will once again be embedded into the project file.

The best advice would be follow jef's solution and disable saving of the Username & Password.

You may however have to manually delete the user credentials from existing project files if QGIS does not remove them after resaving the project.