# The client library is included by PHP, never requested over HTTP.
Options -Indexes

<IfModule mod_authz_core.c>
    <FilesMatch "^(config\.php|.*\.(json|log|md))$">
        Require all denied
    </FilesMatch>
</IfModule>

<IfModule !mod_authz_core.c>
    <FilesMatch "^(config\.php|.*\.(json|log|md))$">
        Order allow,deny
        Deny from all
    </FilesMatch>
</IfModule>

<IfModule mod_rewrite.c>
    RewriteEngine On
    # lib/ and bin/ must never be reachable directly.
    RewriteRule ^(lib|bin)(?:/|$) - [F,L]
</IfModule>
