Ref T7185. These settings shouldn't be unlocked anywhere. Specifically:
- reply-handler: These are on the way out.
- reply-handler-domain: Also hopefully on the way out; locked because a compromised administrator account can redirect replies.
- phabricator.cookie-prefix: Not dangerous per se, but an admin could have a hard time fixing this if they changed it by accident since their session would become invalid immediately.