Committed in git since the initial commit -- contains the DB credentials and the Drupal hash_salt in clear text, already pushed to gitea and prod. Keeping the file locally (still needed for the site to run) but no longer tracked, so future secret rotations don't get recommitted. The already- exposed history is left untouched for now. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>