Answer
Secrets are handled the same as any GitOps app—via Sealed Secrets, External Secrets, or SOPS—referenced by child apps, not stored plaintext in the parent or children. The App of Apps structure doesn't change secret handling; each child pulls secrets through the chosen mechanism.
Real-world example Child apps reference External Secrets that resolve from Vault, so no secrets sit in the App of Apps repo.