# Root .htaccess — for hosts where the document root cannot be pointed at
# public/ (most cPanel shared plans). Rewrites everything into public/ and
# hard-blocks direct access to the application directories.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Refuse to serve anything out of the source directories, ever.
    RewriteRule ^(src|views|config|database|storage|tests|vendor|docs)(/|$) - [F,L]

    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

<FilesMatch "^\.env">
    Require all denied
</FilesMatch>

Options -Indexes
