# Project root. The root itself is NOT blanket-denied (that caused
# Apache's Require-merging to also block the safe index.php redirector
# living here). Instead, each sensitive subfolder denies access to itself
# directly — see app/.htaccess, database/.htaccess, storage/.htaccess.
# Only index.php (a redirector with no app logic) is meant to be reachable
# at this level.
Options -Indexes
