# Deny direct access to sensitive files
<FilesMatch "\.(env|sql|bak|config|ini)$">
  Require all denied
</FilesMatch>

# Recommended: Redirect directory requests to /public/index.php if you later add routing