RewriteEngine On
RewriteBase /
Options -Indexes

# The public/ directory must be the virtual host document root. This file is
# defense in depth only and cannot protect files in parent directories.
RewriteRule "(^|/)[.]" - [F,L]

# Keep real assets accessible and route application requests through the front controller.
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^ index.php [L]

# Deny common sensitive artifacts if this file is accidentally reused elsewhere.
<FilesMatch "^(\.env|.*\.(sql|log|ini|yaml|yml|json|lock))$">
    Require all denied
</FilesMatch>