# Apache: keep non-public files out of reach. Nginx setups need the
# equivalent location blocks (see README, Production notes).

Options -Indexes

# The video library is served only through stream.php (auth + Range); the
# quiz/caption sources only through their endpoints. Direct URLs would
# bypass login entirely.
#
# RedirectMatch always sees the full URL path, even from a .htaccess, so the
# pattern must not assume the app lives at "/" — anchored to the root it
# silently stops matching (and stops protecting) an install under
# "/coursehub/" or any other prefix.
RedirectMatch 404 (^|/)videos/

# App internals — nothing under these is meant to be fetched.
RedirectMatch 404 (^|/)includes/
<FilesMatch "^(config\.php|config\.example\.php|schema\.sql|\.install\.lock|\.gitignore)$">
    Require all denied
</FilesMatch>