{
  "id": "05",
  "content": [
    {
      "type": "heading",
      "text": "Secrets & Configuration Security"
    },
    {
      "type": "text",
      "html": "<pre><code># .env (permissions 640, root:www-data)\nAPP_PEPPER=&lt;hex&gt;\nDB_PASS=&lt;use vault/kms&gt;\n</code></pre>"
    },
    {
      "type": "text",
      "html": "<pre><code class='language-php'>$pep=getenv('APP_PEPPER');\n</code></pre>"
    },
    {
      "type": "text",
      "html": "<pre><code># Linux\nchown root:www-data /var/www/app/.env\nchmod 640 /var/www/app/.env\n</code></pre>"
    }
  ],
  "quiz": {
    "questions": [
      {
        "id": "q1",
        "type": "single",
        "text": "Good place for secrets?",
        "options": [
          {
            "id": "a",
            "text": "Env/secret manager"
          },
          {
            "id": "b",
            "text": "Git repo"
          },
          {
            "id": "c",
            "text": "Public S3"
          }
        ],
        "correct": [
          "a"
        ]
      },
      {
        "id": "q2",
        "type": "single",
        "text": ".env permission example:",
        "options": [
          {
            "id": "a",
            "text": "640 root-owned"
          },
          {
            "id": "b",
            "text": "777"
          },
          {
            "id": "c",
            "text": "666"
          }
        ],
        "correct": [
          "a"
        ]
      }
    ]
  }
}