# ============================================
# Security & Routing Configuration
# ============================================

# Disable directory listing
Options -Indexes

# Protect sensitive files
<FilesMatch "\.(env|json|lock|log|sql|md)$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Protect config files
<Files "config.php">
    Order allow,deny
    Deny from all
</Files>

# Block access to app directory
RedirectMatch 403 ^/app/.*$
RedirectMatch 403 ^/vendor/.*$
RedirectMatch 403 ^/storage/.*$
RedirectMatch 403 ^/install/.*$

# Enable mod_rewrite
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^$ public/ [L]
    RewriteRule (.*) public/$1 [L]
</IfModule>

# Set default charset
AddDefaultCharset UTF-8

# Prevent MIME type sniffing
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "DENY"
    Header set X-XSS-Protection "1; mode=block"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>