# Block direct web access to application internals
RewriteEngine On

# Forbid access to sensitive directories
RewriteRule ^(app|database|includes)/ - [F,L]

# Block common sensitive file types at project root
<FilesMatch "(?i)\.(env|sql|md|log|ini|bak|old|yml|yaml)$">
    Require all denied
</FilesMatch>
