# Block all direct access — all traffic must go through public/
Options -Indexes
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Deny access to sensitive directories
<FilesMatch "\.(env|log|sql|json|lock|ini|sh|bak|md)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>
