# Nothing but the app itself should be downloadable from the web root.
# The install SQL contains the schema and the demo admin account; the docs
# describe internals; none of it is for visitors.
Options -Indexes
<IfModule mod_mime.c>
  AddType application/manifest+json .webmanifest
</IfModule>
# this page may not be shown inside another website's frame (click-jacking)
<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
</IfModule>
# zip/tar/gz: the release ZIP uploaded to cPanel stays in this folder after
# "Extract" — it holds the whole source and install SQL, so never serve it.
<FilesMatch "\.(sql|md|sh|log|bak|json\.bak|ini|zip|tar|gz|tgz)$">
  Require all denied
</FilesMatch>
# release.json / release.sig: the signed file list of a release (Update system)
<FilesMatch "^release\.(json|sig)$">
  Require all denied
</FilesMatch>
<FilesMatch "^\.">
  Require all denied
</FilesMatch>
RedirectMatch 404 ^/tests(/|$)
# The rule above only works when the app sits at the domain root. cPanel
# installs can live in a subfolder (public_html/pharmacy/), where it never matches.
# A rewrite rule in this file is relative to THIS folder, so it holds at any depth.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteRule ^tests(/|$) - [R=404,L]
</IfModule>
