diff --git a/templates/common/infra/bicep/core/host/appservice-appsettings.bicep b/templates/common/infra/bicep/core/host/appservice-appsettings.bicep
index 2286e1f5b4c..574342a8147 100644
--- a/templates/common/infra/bicep/core/host/appservice-appsettings.bicep
+++ b/templates/common/infra/bicep/core/host/appservice-appsettings.bicep
@@ -2,6 +2,7 @@
 param name string
 
 @description('The app settings to be applied to the app service')
+@secure()
 param appSettings object
 
 resource appService 'Microsoft.Web/sites@2022-03-01' existing = {
diff --git a/templates/common/infra/bicep/core/host/appservice.bicep b/templates/common/infra/bicep/core/host/appservice.bicep
index 64eaf388be4..4b029283f12 100644
--- a/templates/common/infra/bicep/core/host/appservice.bicep
+++ b/templates/common/infra/bicep/core/host/appservice.bicep
@@ -23,6 +23,7 @@ param kind string = 'app,linux'
 param allowedOrigins array = []
 param alwaysOn bool = true
 param appCommandLine string = ''
+@secure()
 param appSettings object = {}
 param clientAffinityEnabled bool = false
 param enableOryxBuild bool = contains(kind, 'linux')
diff --git a/templates/common/infra/bicep/core/host/functions.bicep b/templates/common/infra/bicep/core/host/functions.bicep
index 3ba62dedc6e..4f2c9a0f46d 100644
--- a/templates/common/infra/bicep/core/host/functions.bicep
+++ b/templates/common/infra/bicep/core/host/functions.bicep
@@ -30,6 +30,7 @@ param kind string = 'functionapp,linux'
 param allowedOrigins array = []
 param alwaysOn bool = true
 param appCommandLine string = ''
+@secure()
 param appSettings object = {}
 param clientAffinityEnabled bool = false
 param enableOryxBuild bool = contains(kind, 'linux')
diff --git a/templates/todo/common/infra/bicep/app/api-appservice-dotnet.bicep b/templates/todo/common/infra/bicep/app/api-appservice-dotnet.bicep
index a99df66802b..e475ce5a5f7 100644
--- a/templates/todo/common/infra/bicep/app/api-appservice-dotnet.bicep
+++ b/templates/todo/common/infra/bicep/app/api-appservice-dotnet.bicep
@@ -6,6 +6,7 @@ param allowedOrigins array = []
 param appCommandLine string = ''
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-appservice-java.bicep b/templates/todo/common/infra/bicep/app/api-appservice-java.bicep
index 59dd5df3b8e..cedc6d7063a 100644
--- a/templates/todo/common/infra/bicep/app/api-appservice-java.bicep
+++ b/templates/todo/common/infra/bicep/app/api-appservice-java.bicep
@@ -6,6 +6,7 @@ param allowedOrigins array = []
 param appCommandLine string = ''
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-appservice-node.bicep b/templates/todo/common/infra/bicep/app/api-appservice-node.bicep
index 984a7e47b3a..26af262de7d 100644
--- a/templates/todo/common/infra/bicep/app/api-appservice-node.bicep
+++ b/templates/todo/common/infra/bicep/app/api-appservice-node.bicep
@@ -6,6 +6,7 @@ param allowedOrigins array = []
 param appCommandLine string = ''
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-appservice-python.bicep b/templates/todo/common/infra/bicep/app/api-appservice-python.bicep
index 98dbc32bc72..2ce0696ca8f 100644
--- a/templates/todo/common/infra/bicep/app/api-appservice-python.bicep
+++ b/templates/todo/common/infra/bicep/app/api-appservice-python.bicep
@@ -6,6 +6,7 @@ param allowedOrigins array = []
 param appCommandLine string = 'gunicorn --workers 4 --threads 2 --timeout 60 --access-logfile "-" --error-logfile "-" --bind=0.0.0.0:8000 -k uvicorn.workers.UvicornWorker todo.app:app'
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-functions-dotnet-isolated.bicep b/templates/todo/common/infra/bicep/app/api-functions-dotnet-isolated.bicep
index 491dfd460dc..c157fce8d70 100644
--- a/templates/todo/common/infra/bicep/app/api-functions-dotnet-isolated.bicep
+++ b/templates/todo/common/infra/bicep/app/api-functions-dotnet-isolated.bicep
@@ -5,6 +5,7 @@ param tags object = {}
 param allowedOrigins array = []
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-functions-node.bicep b/templates/todo/common/infra/bicep/app/api-functions-node.bicep
index 794482b24f3..bd17763846b 100644
--- a/templates/todo/common/infra/bicep/app/api-functions-node.bicep
+++ b/templates/todo/common/infra/bicep/app/api-functions-node.bicep
@@ -5,6 +5,7 @@ param tags object = {}
 param allowedOrigins array = []
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'
diff --git a/templates/todo/common/infra/bicep/app/api-functions-python.bicep b/templates/todo/common/infra/bicep/app/api-functions-python.bicep
index 73747fe68e0..575c954e1a8 100644
--- a/templates/todo/common/infra/bicep/app/api-functions-python.bicep
+++ b/templates/todo/common/infra/bicep/app/api-functions-python.bicep
@@ -5,6 +5,7 @@ param tags object = {}
 param allowedOrigins array = []
 param applicationInsightsName string = ''
 param appServicePlanId string
+@secure()
 param appSettings object = {}
 param keyVaultName string
 param serviceName string = 'api'