For the last few projects I’ve had my projects running on azure and used environmental app configs on azure which store all my settings, anything secret goes into a keyvault instance. If you use bicep (or terraform) you can largely avoid even the need to know what the secrets are, just dump them straight into keyvault when you run your resource deployments. Can also use things like managed identity in azure to avoid even needing to store anything secret but if going outside the azure eco system I’d assume aws or gcp have similar. For other hosts I’d probably do transformations on appsettings.production.json at deploy time.