# Seals the Laravel source from the web.
#
# On cPanel the application sits INSIDE the web root, next to the built front
# end, which puts backend/.env — database password, APP_KEY — one URL away from
# the open internet. This denies the whole folder.
#
# Apache inherits this into every directory below, including public/, which
# would take the API down with it. backend/public/.htaccess re-opens that one
# directory with "Require all granted". Both halves are required; neither works
# alone. Verify after every deploy:
#
#     curl -I https://your-site/backend/.env             -> must be 403
#     curl -I https://your-site/backend/public/api/auth  -> must be 200
#
# This file used to live only on the server, typed in by hand during the first
# deploy. That made the protection a thing somebody had to remember rather than
# a thing the repository guarantees — and the failure is silent: nothing looks
# broken, the password is simply readable. It ships with the code now.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>
