move vendor into config.private.php