# Block ALL direct browser access to this folder.
# It holds config.php (DB credentials) and the Firebase service-account
# JSON (gives full admin access to the Firebase project). Neither file
# should ever be reachable by a direct URL - they are only meant to be
# loaded server-side via PHP include/require from other scripts, which
# this rule does not affect.

<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
