diff --git a/launcher/saves.py b/launcher/saves.py
index 2a720da0..5bf97074 100644
--- a/launcher/saves.py
+++ b/launcher/saves.py
@@ -393,6 +393,37 @@ def _fresh_file(folder, stem, suffix):
 NO_SAVE = 'the game has no save yet: play until it saves, then export'
 
 
+# Settings whose values stay on the player's PC (runtime/cfg_private.h has the same list): a co-op room's secret and
+# the offer number made for it, the relay's address, the player's name, the key a maker removes, the menu's test hook.
+PRIVATE_SETTINGS = ('coop_room', 'coop_server', 'coop_name', 'coop_accept', 'coop_remove', 'menu_test_set')
+PRIVATE_SHOWN = b'(set, not shown)'
+
+
+def scrub_settings(data):
+    """The bytes of an nx2navi.ini for a bug report: every private setting that has a value reads
+    "key = (set, not shown)"; everything else, comments and line ends included, byte for byte (cfg_ini_scrub in
+    runtime/cfg_private.h does the same for the game's own export)."""
+    out = []
+    for n, line in enumerate(data.split(b'\n')):
+        text = line[:-1] if line.endswith(b'\r') else line
+        start = 3 if n == 0 and text.startswith(b'\xef\xbb\xbf') else 0
+        body = text[start:].lstrip(b' \t')
+        key, eq, value = body.partition(b'=')
+        if (eq and value.strip(b' \t') and body[:1] not in (b'#', b';', b'[')
+                and key.strip(b' \t').lower() in tuple(k.encode() for k in PRIVATE_SETTINGS)):
+            line = text[:text.index(b'=') + 1] + b' ' + PRIVATE_SHOWN + line[len(text):]
+        out.append(line)
+    return b'\n'.join(out)
+
+
+def _add_report_file(z, f):
+    """One file of a bug report into the zip: nx2navi.ini without its private values, anything else as it is."""
+    if f.name == 'nx2navi.ini':
+        z.writestr(REPORT_DIR + f.name, scrub_settings(f.read_bytes()))
+    else:
+        z.write(f, REPORT_DIR + f.name)
+
+
 def _export_log(game, dest, version, log):
     """The bug report of a game without a save (it stopped before its first one): NX2navi-log-<date>_<time>-bug-report.zip
     with the game's latest log, nx2navi.ini and a manifest that counts no save files; import_zip refuses it as a zip
@@ -411,7 +442,7 @@ def _export_log(game, dest, version, log):
         with zipfile.ZipFile(tmp, 'w', zipfile.ZIP_DEFLATED) as z:
             z.writestr(MANIFEST, json.dumps(manifest, indent=1) + '\n')
             for f in extras:
-                z.write(f, REPORT_DIR + f.name)
+                _add_report_file(z, f)
         os.replace(tmp, out)
     except BaseException:
         tmp.unlink(missing_ok=True)
@@ -456,7 +487,7 @@ def export_save(game, dest=None, bug_report=False, version='', log=print):
                 for rel in files:
                     z.write(current / rel, SAVE_DIR + rel.as_posix())
                 for f in extras:
-                    z.write(f, REPORT_DIR + f.name)
+                    _add_report_file(z, f)
             os.replace(tmp, out)
         except FileNotFoundError:
             tmp.unlink(missing_ok=True)
diff --git a/nx2navi.ini.example b/nx2navi.ini.example
index 4a34dbc3..52cf4a25 100644
--- a/nx2navi.ini.example
+++ b/nx2navi.ini.example
@@ -714,15 +714,8 @@
 # Default: every cheat off.
 # cheat_0123abcd = 1
 
-[restorations]
-# Things the original game did that this release changed, each switched on (1) or off (0) on its own, also on the
-# Restorations tab of the menu (F1). Read at start: once, as the game starts, it edits its own files on this PC for the
-# ones switched on and logs each edit, or why it skipped one (a mod or another game version changed what it edits),
-# so a change takes effect at the next start. docs/restorations.md.
-# Default: every one off.
-
 [diagnostics]
-# Extra lines in the log, comma separated: svc, host, ipc, fs, gfx, perf, sched, audio, present or all. The menu's
+# Extra lines in the log, comma separated: svc, host, ipc, fs, gfx, perf, sched, audio, present, coop or all. The menu's
 # Performance log sets perf (frame timings). Default: none.
 # trace = perf
 # 1: with trace = perf, walks of the process's address space count its private and write-combined memory every 600
diff --git a/runtime/cfg.c b/runtime/cfg.c
index ccff96cc..155e1665 100644
--- a/runtime/cfg.c
+++ b/runtime/cfg.c
@@ -12,6 +12,7 @@
 #include <string.h>
 
 #include "cfg.h"
+#include "cfg_private.h"
 #include "coop_app.h"
 #include "discord_app.h"
 #include "host.h"
@@ -315,8 +316,7 @@ static const CfgMeta metas[] = {
 static int is_known(const char *key) {
     for (size_t i = 0; i < sizeof known / sizeof *known; i++)
         if (!strcmp(known[i], key)) return 1;
-    return !strncmp(key, "CHEAT_", 6)      // cheats.c and the cheat patch sets (tools/cheats.py)
-           || !strncmp(key, "RESTORE_", 8);   // restore.c: one key per restoration
+    return !strncmp(key, "CHEAT_", 6);   // cheats.c and the cheat patch sets (tools/cheats.py)
 }
 
 // The keys of the file's lines that are not settings of this version (add), lower-case, ", " between them, each once;
@@ -817,7 +817,6 @@ static const char *section_of(const char *key) {
     for (size_t i = 0; i < sizeof sections / sizeof *sections; i++)
         if (!strcmp(sections[i].key, key)) return sections[i].section;
     if (!strncmp(key, "CHEAT_", 6)) return "cheats";   // cheats.c: one key per cheat of the cheat file
-    if (!strncmp(key, "RESTORE_", 8)) return "restorations";   // restore.c: one key per restoration
     return NULL;
 }
 
@@ -1004,13 +1003,15 @@ static void log_file_settings(void) {
         char key[64];
         snprintf(key, sizeof key, "%s", entries[i].key);
         for (char *p = key; *p; p++) *p = (char)tolower((unsigned char)*p);
-        size_t vl = strlen(entries[i].value);
+        // a co-op room's secret, the relay, the player's name: only that they are set (cfg_private.h)
+        const char *value = cfg_private_key(entries[i].key) && entries[i].value[0] ? CFG_PRIVATE_SHOWN : entries[i].value;
+        size_t vl = strlen(value);
         if (vl > 200) vl = 200;   // a long value (a list of mods) is cut: the line shows that the key is set
         if (k && k + strlen(key) + vl + 5 > 900) {
             rt_log("cfg: nx2navi.ini sets: %s", line);
             k = 0;
         }
-        k += (size_t)snprintf(line + k, sizeof line - k, "%s%s = %.*s", k ? ", " : "", key, (int)vl, entries[i].value);
+        k += (size_t)snprintf(line + k, sizeof line - k, "%s%s = %.*s", k ? ", " : "", key, (int)vl, value);
     }
     if (k) rt_log("cfg: nx2navi.ini sets: %s", line);
     if (n_unknown)
diff --git a/runtime/cfg_private.h b/runtime/cfg_private.h
new file mode 100644
index 00000000..6da440cb
--- /dev/null
+++ b/runtime/cfg_private.h
@@ -0,0 +1,71 @@
+// Settings whose values stay on the player's PC: a co-op room's secret and the offer number made for it, the relay's
+// address, the player's name, the key a maker removes, and the menu's test hook (which can carry a secret). The log's
+// line of what nx2navi.ini sets (cfg.c log_file_settings), "Copy system info" (sysinfo.c) and the copy of nx2navi.ini a
+// bug report takes along (save_share.c; launcher/saves.py has the same list) show only that such a key is set.
+// Header only, so that the tests that build one of those files alone need nothing else.
+#ifndef NX2NAVI_CFG_PRIVATE_H
+#define NX2NAVI_CFG_PRIVATE_H
+
+#include <ctype.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define CFG_PRIVATE_SHOWN "(set, not shown)"
+
+// key: a setting's name without the NX2NAVI_ prefix, in any case, n bytes of it.
+static inline int cfg_private_key_n(const char *key, size_t n) {
+    static const char *const keys[] = {"COOP_ROOM", "COOP_SERVER", "COOP_NAME", "COOP_ACCEPT", "COOP_REMOVE",
+                                       "MENU_TEST_SET"};
+    for (size_t i = 0; i < sizeof keys / sizeof *keys; i++) {
+        size_t k = 0;
+        while (k < n && keys[i][k] && toupper((unsigned char)key[k]) == keys[i][k]) k++;
+        if (k == n && !keys[i][k]) return 1;
+    }
+    return 0;
+}
+
+static inline int cfg_private_key(const char *key) { return cfg_private_key_n(key, strlen(key)); }
+
+// A copy of the text of an nx2navi.ini (n bytes) in which every private key that has a value reads
+// "key = (set, not shown)"; everything else, comments and line ends included, byte for byte. malloc'd, *out_n its
+// length; NULL when memory runs out.
+static inline char *cfg_ini_scrub(const char *text, size_t n, size_t *out_n) {
+    size_t lines = 1;
+    for (size_t i = 0; i < n; i++) lines += text[i] == '\n';
+    char *out = malloc(n + lines * sizeof CFG_PRIVATE_SHOWN + 1);
+    if (!out) return NULL;
+    size_t o = 0;
+    for (size_t at = 0; at < n;) {
+        size_t end = at;
+        while (end < n && text[end] != '\n') end++;
+        size_t stop = end;   // the line's text without its line end
+        if (stop > at && text[stop - 1] == '\r') stop--;
+        size_t k0 = at;
+        if (at == 0 && n >= 3 && !memcmp(text, "\xEF\xBB\xBF", 3)) k0 = 3;   // a byte order mark before the first key
+        while (k0 < stop && (text[k0] == ' ' || text[k0] == '\t')) k0++;
+        size_t eq = k0;
+        while (eq < stop && text[eq] != '=') eq++;
+        size_t k1 = eq;
+        while (k1 > k0 && (text[k1 - 1] == ' ' || text[k1 - 1] == '\t')) k1--;
+        size_t v0 = eq < stop ? eq + 1 : stop;
+        while (v0 < stop && (text[v0] == ' ' || text[v0] == '\t')) v0++;
+        int hide = eq < stop && v0 < stop && text[k0] != '#' && text[k0] != ';' && text[k0] != '[' &&
+                   cfg_private_key_n(text + k0, k1 - k0);
+        if (hide) {
+            memcpy(out + o, text + at, eq + 1 - at), o += eq + 1 - at;
+            out[o++] = ' ';
+            memcpy(out + o, CFG_PRIVATE_SHOWN, sizeof CFG_PRIVATE_SHOWN - 1), o += sizeof CFG_PRIVATE_SHOWN - 1;
+            memcpy(out + o, text + stop, end - stop), o += end - stop;   // a carriage return, if the line had one
+        } else {
+            memcpy(out + o, text + at, end - at), o += end - at;
+        }
+        if (end < n) out[o++] = '\n';
+        at = end + 1;
+    }
+    out[o] = 0;
+    *out_n = o;
+    return out;
+}
+
+#endif
diff --git a/runtime/coop.h b/runtime/coop.h
index aeadf787..1f454ee6 100644
--- a/runtime/coop.h
+++ b/runtime/coop.h
@@ -1,6 +1,6 @@
 // Co-op session layer: one host thread, "coop", owns a UDP socket to a relay (tools/coop_relay.py), keeps the player in a
 // room of up to 8 and carries the messages the players send each other (coop_proto.h: the wire format). It never holds a
-// virtual core and never touches game state: progress sync and the player ghosts are layers above this one, which send
+// virtual core and never touches game state: progress sync is a layer above this one, which send
 // with coop_send and receive with coop_on_message. The game's own nn::socket stays offline.
 //
 // Threads. Everything below the "process" heading may be called from any thread; the callbacks run on the coop thread
diff --git a/runtime/main.c b/runtime/main.c
index c40b1bc7..ac0a8c59 100644
--- a/runtime/main.c
+++ b/runtime/main.c
@@ -1,4 +1,4 @@
-// nx2navi.exe entry: reserves the guest address space, parses the command line and runs one mode.
+// nx2navi.exe entry: reserves the guest address space, parses the command line and runs one mode.
 //
 //   nx2navi.exe [--exefs DIR] [--romfs DIR] [--profile DIR] [--audio-device VALUE] [--monitor VALUE] <mode>
 //     --audio-device VALUE   play the sound on one output device: sets NX2NAVI_AUDIO_DEVICE before the settings are read, so
diff --git a/runtime/save_share.c b/runtime/save_share.c
index 43a8f0e1..0e4c30e2 100644
--- a/runtime/save_share.c
+++ b/runtime/save_share.c
@@ -13,6 +13,7 @@
 #include <string.h>
 #include <time.h>
 
+#include "cfg_private.h"
 #include "folder_pick.h"
 #include "fs.h"
 #include "host.h"
@@ -118,6 +119,19 @@ static void add_file(Export *e, const char *name, const char *path) {
     free(data);
 }
 
+// nx2navi.ini for a bug report: as it is, except that the values of the private settings (cfg_private.h: a co-op
+// room's secret, the relay, the player's name) read "(set, not shown)". A report goes to people the player does not
+// know, and the secret lets anyone into the room.
+static void add_settings_file(Export *e, const char *name, const char *path) {
+    uint64_t n = 0;
+    uint8_t *data = plat_file_read(path, &n);
+    size_t sn = 0;
+    char *scrubbed = data ? cfg_ini_scrub((const char *)data, (size_t)n, &sn) : NULL;
+    if (scrubbed) sz_writer_add(&e->w, name, scrubbed, sn);
+    free(scrubbed);
+    free(data);
+}
+
 SaveShareResult save_share_export(const char *dir, int bug_report, char *path, size_t cap) {
     *path = 0;
     struct tm t;
@@ -137,7 +151,7 @@ SaveShareResult save_share_export(const char *dir, int bug_report, char *path, s
         add_file(&e, "bug-report/nx2navi.log", rt_log_path());
         if (exe_dir(base, sizeof base)) {
             snprintf(file, sizeof file, "%s/nx2navi.ini", base);
-            add_file(&e, "bug-report/nx2navi.ini", file);
+            add_settings_file(&e, "bug-report/nx2navi.ini", file);
         }
     }
     struct tm u;
diff --git a/runtime/sysinfo.c b/runtime/sysinfo.c
index 6a1f1e3f..03e86e6d 100644
--- a/runtime/sysinfo.c
+++ b/runtime/sysinfo.c
@@ -8,6 +8,7 @@
 #endif
 
 #include "cfg.h"
+#include "cfg_private.h"
 #include "host.h"
 #include "platform/platform.h"
 #include "sysinfo.h"
@@ -54,15 +55,10 @@ static void put(Out *o, const char *fmt, ...) {
 
 // The co-op room's secret and the offer number made from it, the relay's address and the player's name stay out of a
 // text that ends up in bug reports: only whether they are set.
-static int private_setting(const char *key) {
-    static const char *const keys[] = {"COOP_ROOM", "COOP_SERVER", "COOP_NAME", "COOP_ACCEPT"};
-    for (size_t i = 0; i < sizeof keys / sizeof *keys; i++)
-        if (!strcmp(key, keys[i])) return 1;
-    return 0;
-}
+static int private_setting(const char *key) { return cfg_private_key(key); }   // cfg_private.h: one list for all
 
 static void put_setting(const char *key, const char *value, int from_env, void *ctx) {
-    if (private_setting(key)) value = "(set, not shown)";
+    if (private_setting(key)) value = CFG_PRIVATE_SHOWN;
     put(ctx, from_env ? "  NX2NAVI_%s=%s (environment)\n" : "  %s = %s\n", key, value);
 }
 
diff --git a/runtime/ui/menu_text_input.cpp b/runtime/ui/menu_text_input.cpp
index 17bb471a..1fa7158a 100644
--- a/runtime/ui/menu_text_input.cpp
+++ b/runtime/ui/menu_text_input.cpp
@@ -1,5 +1,5 @@
-// The window's text input follows the menu's text fields (ui/menu.h menu_text_input_follow). Its own file, so that the
-// page test (tests/saves_page_check.cpp) runs the same switch the menu does without the menu's Vulkan side.
+// The window's text input follows the menu's text fields (ui/menu.h menu_text_input_follow). Its own file, so that a
+// page test can run the same switch the menu does without the menu's Vulkan side.
 #include "ui/menu.h"
 
 static int g_text_on;   // what the window was last told; off at start, as the window makes it
diff --git a/tests/launcher_test.py b/tests/launcher_test.py
index ce0c1a4e..47aaefea 100644
--- a/tests/launcher_test.py
+++ b/tests/launcher_test.py
@@ -3866,6 +3866,24 @@ class SaveShareTest(unittest.TestCase):
         self.assertFalse([n for n in names if 'keys' in n])
         self.assertEqual(len([n for n in names if n.startswith('save/')]), len(self.SAVE))
 
+    def test_a_bug_report_keeps_the_private_settings_values_out(self):
+        """A co-op room's secret, the relay and the player's name are not in the nx2navi.ini a bug report carries;
+        every other byte of the file is."""
+        ini = (b'\xef\xbb\xbf[coop]\r\ncoop = 1\r\n  Coop_Room = H7K3WM-BCDFGH-234567\r\ncoop_server=relay.example:24680\r\n'
+               b'# coop_name = in a comment\r\ncoop_name =\r\ncoop_accept = 1a2b3c4d\nfps_limit = 60')
+        self.game_with_save(self.game, self.SAVE)
+        self.files(self.game, {'logs/nx2navi.log': b'the log', 'nx2navi.ini': ini})
+        r = saves.export_save(self.game, self.out, bug_report=True, log=lambda m: None)
+        with zipfile.ZipFile(r['path']) as z:
+            got = z.read('bug-report/nx2navi.ini')
+        self.assertEqual(got, b'\xef\xbb\xbf[coop]\r\ncoop = 1\r\n  Coop_Room = (set, not shown)\r\n'
+                              b'coop_server= (set, not shown)\r\n# coop_name = in a comment\r\ncoop_name =\r\n'
+                              b'coop_accept = (set, not shown)\nfps_limit = 60')
+        for secret in (b'H7K3WM', b'relay.example', b'1a2b3c4d'):
+            self.assertNotIn(secret, got)
+        self.assertEqual(saves.scrub_settings(b'[x]'), b'[x]')
+        self.assertEqual(saves.scrub_settings(b''), b'')
+
     def test_no_save_no_export(self):
         with self.assertRaises(saves.SaveError):
             saves.export_save(self.game, self.out, log=lambda m: None)   # a game that never ran