# CTF 1405 — API front controller subtree.
# This is the ONLY web-reachable area of /api (the parent api/.htaccess
# [F]-blocks every other sub-tree). Guard rail: still refuse sensitive file
# types that might ever land here.
<FilesMatch "(?i)\.(env|env\.example|json|ini|bak|sql|log|dist|lock|cache)$">
    Require all denied
</FilesMatch>

# Runtime PHP logs carry no dot-extension (error_log), so the rule above misses
# them — deny any dotless "*_log" file by name. Evidence: the deployed copy of
# this directory contained full phone numbers in error_log lines.
<FilesMatch "(?i)^(error_log|access_log|debug_log|.+_log)$">
    Require all denied
</FilesMatch>