# Block direct web access to sensitive files.
# Without this, files like .env (DB credentials) or a stray .sql
# export could be fetched directly by anyone who guesses the URL,
# even though PHP files execute normally.

<FilesMatch "^\.env$">
    Require all denied
</FilesMatch>

<FilesMatch "\.(sql|log|md|ini|bak)$">
    Require all denied
</FilesMatch>

# Block browsing the database/ folder (for schema exports, backups, etc.)
<IfModule mod_alias.c>
    RedirectMatch 403 ^/loyalty-card/database/.*$
</IfModule>

Options -Indexes
