<?php
/**
 * TraderAlign — LOCAL environment overrides. NEVER COMMITTED (see
 * .gitignore) — this is the one file where real secrets are allowed to
 * live. Loaded by config.php, before its own defaults, if this file
 * exists. Every value here is real for THIS machine's local dev setup
 * only; a staging/production deployment needs its own separate
 * config.local.php with its own real values, generated the same way
 * (never copy this exact file's secrets anywhere else).
 *
 * Regenerate CRON_SECRET / ACCOUNT_CREDENTIAL_KEY at any time with:
 *   php -r "echo bin2hex(random_bytes(32));"
 * Changing ACCOUNT_CREDENTIAL_KEY invalidates every already-encrypted
 * broker_password_encrypted value in the DB (they'll fail to decrypt) — only
 * rotate it alongside clearing/re-entering those fields.
 */

define('APP_ENV', 'development');

// Generated 2026-08-19 during the pre-launch security audit remediation
// pass, specifically to close the confirmed-live cron/daily.php exploit
// (the app had shipped with the literal placeholder value as its only
// secret). Real, random, 32 bytes / 256 bits of entropy.
define('CRON_SECRET', '716386b744b34c4e824c70840678c309a78072d62ec9da8ddc496b97f21e95b7');

// Generated the same session — this key derives (via SHA-256,
// src/CredentialCrypto.php) the AES-256-GCM key that encrypts every
// stored broker platform password. Real, random, 32 bytes / 256 bits.
define('ACCOUNT_CREDENTIAL_KEY', '4acc6255bcd8e3f2e16ef1b8cd1b7d15e539608118d96d27d04e211a2b9d5adf');
