# Security guard for hosts that accidentally point the domain to the project root.
# Production document root must be the /public directory.
<FilesMatch "^(\.env|env\.example|\.env\.example|composer\.(json|lock)|docker-compose\.yml)$">
    Require all denied
</FilesMatch>

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^(app|config|database|storage|tests|docs|scripts)(/|$) - [F,L]
</IfModule>
