# Deployed into the docroot on every deploy (see bin/deploy.sh) - the
# reverse proxy to the Next.js app is configured at the vhost level, not
# here, so this file's only job is to stop LiteSpeed from serving files
# straight off disk before a request ever reaches the proxy. Without this,
# a direct request for /.env (which lives right next to the rest of the
# app in this same directory) gets served as a plain static file with all
# the app's secrets in it.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Fallback for older Apache/LiteSpeed builds without mod_authz_core.
<IfModule !mod_authz_core.c>
    <FilesMatch "^\.">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>