fabs/ZapMachine
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

removed kanban from gitignore

Browse source
This commit is contained in:
Fabian de Boer 2026-07-19 22:49:00 +02:00
commit ffab9dc4da
28 changed files with 522 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

19
kanban/tasks/013-config-hygiene-zap-debug-false-secrets-in-git.md Normal file
View file

@ -0,0 +1,19 @@
---
id: 13
title: 'Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms'
status: done
priority: medium
created: 2026-07-17T03:57:13.88777683+02:00
updated: 2026-07-17T22:27:10.989415474+02:00
started: 2026-07-17T22:27:10.994979516+02:00
completed: 2026-07-17T22:27:10.994979516+02:00
tags:
- security
- config
class: standard
---
From framework review (docs/framework_review.md), P1-1. conf/conf.php is git-tracked and ships with ZAP_DEBUG=true, BRAVE_API_KEY='your api key' placeholder. Fixes:
- Default ZAP_DEBUG=false in committed conf.php
- Add git-ignored conf/conf.local.php loaded by init.php if present, for secrets
- Tighten sessions/ permissions from 777 to 770 (or document webserver-user group)