So I\'ve been following many different idea/strategies through many blogs/SO posts but I haven\'t been able to find my idea solution.
VSRM task to publish Web Apps supports overriding values in Web.config. You can keep your secrets in VSRM and replace them in the deployment time. See File transforms and variable substitution reference # XML variable substitution