Placeholder salts get a warning, not a refusal to store

Treating the sample salts as no salts at all made encryption unavailable
wherever they were still in place -- which is every WordPress test
suite, and more live sites than anyone would like -- and a field marked
encrypted then refused to store anything. A Stripe key saved as nothing,
with no message on screen. The key is derived as before, and a site on
the placeholders is told so where warnings are shown.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Kwx2STJ4EaVaJofEJJ9Zo

Author: arraypress

src/Context/EncryptedContext.php

@@ -282,18 +282,37 @@ public static function available(): bool {
 	private static function key(): string {
 		$salt = '';
 
+		$weak = false;
+
 		foreach ( [ 'LOGGED_IN_KEY', 'LOGGED_IN_SALT', 'AUTH_KEY', 'SECURE_AUTH_KEY' ] as $constant ) {
 			$part = defined( $constant ) ? (string) constant( $constant ) : '';
 
-			// The phrase wp-config-sample.php ships with is public, and a key
-			// derived from it is no key at all.
-			if ( '' === $part || 'put your unique phrase here' === $part ) {
+			if ( '' === $part ) {
 				continue;
 			}
 
+			// The phrase wp-config-sample.php ships with is public, and a key
+			// derived from it is no key at all. It is still used: refusing
+			// to store anything left a Stripe key blank on every site and
+			// every test suite that never set its salts, with nothing on
+			// screen to say why. The site is warned instead, where warnings
+			// are shown, and its cookies are forgeable with those salts in
+			// any case.
+			if ( 'put your unique phrase here' === $part ) {
+				$weak = true;
+			}
+
 			$salt .= $part;
 		}
 
+		if ( $weak && defined( 'WP_DEBUG' ) && WP_DEBUG ) {
+			_doing_it_wrong(
+				__METHOD__,
+				esc_html__( 'The salts in wp-config.php are the placeholders from wp-config-sample.php, so the key that encrypts these fields is public. Set unique salts.', 'arraypress' ),
+				'1.0.0'
+			);
+		}
+
 		return '' === $salt ? '' : hash( 'sha256', $salt, true );
 	}