Options -Indexes
<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
# Access-Control-Allow-Origin is intentionally NOT set here - it's set
# once, dynamically, in helpers/response.php (respecting the optional
# CORS_ALLOWED_ORIGIN env var). Setting it in both places would send
# two ACAO header values on the same response, which browsers treat
# as an invalid CORS response and block outright.

# Never allow config/env/sql/log files to be served directly, no matter
# where they live under backend/. .env is deliberately not present in
# this project (real config comes from real environment variables, see
# config/db.php), but this blocks it defensively in case one is ever
# added to the server for local convenience.
<FilesMatch "(^\.env.*|\.sql$|\.log$|\.md$|composer\.(json|lock)|\.gitignore)$">
    Require all denied
</FilesMatch>

# Config/helpers folders contain no public entry points - block direct
# HTTP access to them entirely. Only files under api/ should be reachable.
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^config/ - [F,L]
    RewriteRule ^helpers/ - [F,L]
</IfModule>
