# RSR QR Print — project-root hardening.
#
# The application must ONLY be served from the public/ directory (point the
# production vhost / cPanel document root there). These rules are a safety net
# for environments where the web root points at the project root instead
# (e.g. local XAMPP with docroot C:\xampp\htdocs): they block HTTP access to
# secrets and server files while leaving normal /public/... traffic untouched.

# Secrets: .env and its backups must never be downloadable.
<FilesMatch "^\.env">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>

# Composer / CLI / CI files.
<FilesMatch "^(composer\.(json|lock)|artisan|phpunit\.xml|package\.json|package-lock\.json|webpack\.vite\.config)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
