Options -Indexes

# Deny direct access to sensitive files
<FilesMatch "^\.env|composer\.(json|lock)$">
    Require all denied
</FilesMatch>

# If your document root points to /public (recommended), this file isn't
# strictly needed, but keeping it here blocks indexing if misconfigured.
