ZapMachine/kanban/tasks/013-config-hygiene-zap-debug-false-secrets-in-git.md

id	title	status	priority	created	updated	started	completed	tags	class
13	Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms	done	medium	2026-07-17T03:57:13.88777683+02:00	2026-07-17T22:27:10.989415474+02:00	2026-07-17T22:27:10.994979516+02:00	2026-07-17T22:27:10.994979516+02:00	security config	standard

From framework review (docs/framework_review.md), P1-1. conf/conf.php is git-tracked and ships with ZAP_DEBUG=true, BRAVE_API_KEY='your api key' placeholder. Fixes:

• Default ZAP_DEBUG=false in committed conf.php
• Add git-ignored conf/conf.local.php loaded by init.php if present, for secrets
• Tighten sessions/ permissions from 777 to 770 (or document webserver-user group)