# Deny direct web access to non-public directories
RewriteEngine On

<FilesMatch "\.(env|sql)$">
  Require all denied
</FilesMatch>

# If someone requests /config/ or /includes/ or /sql/ directly, block it
RewriteRule ^(config|includes|sql|scripts)/ - [F,L]

# Everything else is served as-is (public/ and admin/ and api/ contain the actual entry points)
