# Block direct browser access to sensitive files that must never be served.
<FilesMatch "^(\.env.*|config\.php\.bak|migrations.*\.sql|\.git.*)$">
    Require all denied
</FilesMatch>

# Fallback for older Apache (2.2) that doesn't understand "Require all denied"
<IfModule !mod_authz_core.c>
    <FilesMatch "^(\.env.*|config\.php\.bak|migrations.*\.sql|\.git.*)$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>
