I guess the answer is to ...
- ...not have all users in the sysadmins SQL Server role.
- ...not have all users in the db_owner database role.
- ...not have all users in the showplan SQL Server role.
Show exection plan
Here a bit of information regarding execution plan visibility:
Users who have SHOWPLAN, ALTER TRACE, or VIEW SERVER STATE permission can view queries that are captured in Showplan output. These queries may contain sensitive information such as passwords. Therefore, we recommend that you only grant these permissions to users who are authorized to view sensitive information, such as members of the db_owner fixed database role, or members of the sysadmin fixed server role. We also recommend that you only save Showplan files or trace files that contain Showplan-related events to a location that uses the NTFS file system, and that you restrict access to users who are authorized to view sensitive information.
Reference: Showplan Security (TechNet)
If somebody still has access to the execution plan revoke the permission with
REVOKE VIEW SERVER STATE to [user_name]
...for the SERVER STATE permissions and ...
REVOKE SHOWPLAN to [user_name]
...for the SHOWPLAN permissions and ...
REVOKE ALTER TRACE to [user_name]
...and really test the [user_name] that will be logging in to the SQL Server instance. This would apply a small layer of protection against reverse engineering.
GRANT Server Permissions (Transact-SQL)
Syntax for Granting, Denying, and Revoking the SHOWPLAN Permission
Showplan Security (TechNet)
REVOKE Server Permissions (Transact-SQL)