I am storing database passwords in app.config as plain text. I am also publishing the application.
How safe is that password stored in app.config? Can I use a disassembler and find it?
No, you cannot find the password with a disassembler. But you can read it plain as day if someone compromises your web server. At the very least, check these links:
Better yet, do not use SQL Server Security and instead use Integrated Security and only allow the account your web app (pool) runs under to access the DB.