---
id: 13
title: 'Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms'
status: done
priority: medium
created: 2026-07-17T03:57:13.88777683+02:00
updated: 2026-07-17T22:27:10.989415474+02:00
started: 2026-07-17T22:27:10.994979516+02:00
completed: 2026-07-17T22:27:10.994979516+02:00
tags:
    - security
    - config
class: standard
---

From framework review (docs/framework_review.md), P1-1. conf/conf.php is git-tracked and ships with ZAP_DEBUG=true, BRAVE_API_KEY='your api key' placeholder. Fixes:
- Default ZAP_DEBUG=false in committed conf.php
- Add git-ignored conf/conf.local.php loaded by init.php if present, for secrets
- Tighten sessions/ permissions from 777 to 770 (or document webserver-user group)