# Safety net for hosting setups where the whole project (not just public/)
# ends up under the web-accessible document root. Blocks direct access to
# everything except the public/ front controller and its assets.
# (Best practice is still to point your domain's document root at public/
# directly — see README-deploy-cpanel.md.)

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
