19 lines
746 B
Markdown
19 lines
746 B
Markdown
---
|
|
id: 13
|
|
title: 'Config hygiene: ZAP_DEBUG=false, secrets in git-ignored local file, sessions perms'
|
|
status: done
|
|
priority: medium
|
|
created: 2026-07-17T03:57:13.88777683+02:00
|
|
updated: 2026-07-17T22:27:10.989415474+02:00
|
|
started: 2026-07-17T22:27:10.994979516+02:00
|
|
completed: 2026-07-17T22:27:10.994979516+02:00
|
|
tags:
|
|
- security
|
|
- config
|
|
class: standard
|
|
---
|
|
|
|
From framework review (docs/framework_review.md), P1-1. conf/conf.php is git-tracked and ships with ZAP_DEBUG=true, BRAVE_API_KEY='your api key' placeholder. Fixes:
|
|
- Default ZAP_DEBUG=false in committed conf.php
|
|
- Add git-ignored conf/conf.local.php loaded by init.php if present, for secrets
|
|
- Tighten sessions/ permissions from 777 to 770 (or document webserver-user group)
|