- gitignore config/security-private.php (CSRF/nonce + rate-limit signing salt); it is a per-install secret Grav auto-generates and its own header says not to commit. Each environment now keeps its own uncommitted salt. - drop the runtime-generated popularity.salt from api.yaml; Grav re-derives it per install. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Np4cMQLF77i664CAQXySzU