# Probance API — deny direct HTTP access to non-public module files.
#
# Deliberately scoped to sensitive extensions rather than the whole directory: logo.png is
# fetched over HTTP by the Back Office module list, so a blanket deny would break it.
#
# Apache-only, ignored by nginx. Defence in depth, not the primary protection.

<FilesMatch "\.(key|lock|json|sh|dist|log|bak|sql)$">
    <IfModule mod_authz_core.c>
        # Apache 2.4 and later
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        # Apache 2.2 and earlier
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
