Problem: the visitor hash salt looks like analytics-${date} (predictable → visitor hashes are guessable/correlatable).
Scope: seed the daily salt from a server secret; rotate daily; never expose it.
Done when: visitor hashes can't be reproduced without the secret.