# Deny web access to everything in the project root (src/, database/, .env, storage/).
# Only public/ is reachable — it re-grants access in its own .htaccess.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
