# Root .htaccess
# If your cPanel docroot is the PROJECT ROOT (not /public), this forwards
# all traffic into /public so app source stays out of the web root.
# Preferred setup: set the domain Document Root to .../public directly and
# this file becomes unnecessary. Keep it as a safety net.

<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to sensitive files even if mis-served
    RewriteRule ^\.env - [F,L]
    RewriteRule ^(app|config|database|routes|resources|storage|cron)/ - [F,L]

    # Forward everything to /public
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

# Deny listing
Options -Indexes
