Q: Is app.php really meant to be in .gitignore?

[HarderWork]

/config/app.php in .gitignore makes sense (I guess) when developing the app skeleton, but it should be changed when I use "composer create project" for my project.

This is inherited from "original" app skeleton: https://github.com/cakephp/app/blob/master/.gitignore

[josegonzalez]

That comes from upstream CakePHP/app.

I still gitignore it because not doing so encourages devs to commit it with secrets, whereas the default implies no secrets.

All clones/install of the app call the installer for me, which in this skeleton just uses env vars so everything works fine.