746 B
746 B
| id | title | status | priority | created | updated | started | completed | tags | class | ||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 13 | Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms | done | medium | 2026-07-17T03:57:13.88777683+02:00 | 2026-07-17T22:27:10.989415474+02:00 | 2026-07-17T22:27:10.994979516+02:00 | 2026-07-17T22:27:10.994979516+02:00 |
|
standard |
From framework review (docs/framework_review.md), P1-1. conf/conf.php is git-tracked and ships with ZAP_DEBUG=true, BRAVE_API_KEY='your api key' placeholder. Fixes:
- Default ZAP_DEBUG=false in committed conf.php
- Add git-ignored conf/conf.local.php loaded by init.php if present, for secrets
- Tighten sessions/ permissions from 777 to 770 (or document webserver-user group)