RewriteEngine On

# Route everything through the front controller except real files/dirs
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

# Block direct access to sensitive extensions inside public/
<FilesMatch "\.(env|sql|log|md)$">
    Require all denied
</FilesMatch>

Options -Indexes
