From 28400183728dd5e572060473e5c4809337c9743a Mon Sep 17 00:00:00 2001
From: Mischa <mischa@gorinskat.nl>
Date: Sun, 5 Jul 2026 00:26:41 +0200
Subject: [PATCH] chore: stop tracking per-install secrets in config

- gitignore config/security-private.php (CSRF/nonce + rate-limit signing
  salt); it is a per-install secret Grav auto-generates and its own header
  says not to commit. Each environment now keeps its own uncommitted salt.
- drop the runtime-generated popularity.salt from api.yaml; Grav re-derives
  it per install.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU
---
 .gitignore                  | 1 +
 config/plugins/api.yaml     | 1 -
 config/security-private.php | 7 -------
 3 files changed, 1 insertion(+), 8 deletions(-)
 delete mode 100644 config/security-private.php

diff --git a/.gitignore b/.gitignore
index 8b1c03d..219ceb2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,5 +9,6 @@
 /config/plugins/git-sync.yaml
 /config/plugins/api-private.php
 /config/security.yaml
+/config/security-private.php
 /config/versions.yaml
 /themes/intotheeast/node_modules/
diff --git a/config/plugins/api.yaml b/config/plugins/api.yaml
index 945a4e8..e3b1e18 100644
--- a/config/plugins/api.yaml
+++ b/config/plugins/api.yaml
@@ -57,4 +57,3 @@ popularity:
   ignore:
     - '/test*'
     - /modular
-  salt: 37517ad926e4f900863af7f1b58718cdccc34f7265dedd09d33b6f820046c510
diff --git a/config/security-private.php b/config/security-private.php
deleted file mode 100644
index f4deb76..0000000
--- a/config/security-private.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php
-
-// Auto-generated private secret. Do NOT commit to version control.
-// Used for CSRF nonce signing and admin rate-limit hashing. Regenerate by
-// deleting this file; the next request will write a new value.
-
-return 'lsUHWFkCwvGZrL';