big

config/config.php

@@ -1,6 +1,12 @@
 <?php
 declare(strict_types=1);
 
+// Local server secrets live outside the public webroot and are never committed.
+$localSecrets = __DIR__ . '/secrets.local.php';
+if (is_file($localSecrets)) {
+    require_once $localSecrets;
+}
+
 // Basic error reporting (keep strict in dev)
 ini_set('display_errors', '1');
 ini_set('display_startup_errors', '1');