# If your hosting panel forces the web root to this project folder instead of
# public/, this blocks direct access to everything except public/ and admin/.
# Preferred setup: point the domain's document root AT public/ directly.

<FilesMatch "^\.env">
    Require all denied
</FilesMatch>

RewriteEngine On
RewriteCond %{REQUEST_URI} !^/public/
RewriteCond %{REQUEST_URI} !^/admin/
RewriteRule ^(app|database|cron|storage)/ - [F,L]
