# Bexley Podiatry — form API security

# Block direct HTTP access to dotfiles (.env, .env.local, .git, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Belt-and-braces: explicitly deny the env files in case the rule
# above is overridden by host config.
<Files ".env">
    Require all denied
</Files>
<Files ".env.example">
    Require all denied
</Files>
