# Apache: keep non-public files out of reach. Nginx setups need the
# equivalent location blocks (see README, Production notes).

Options -Indexes

# The video library is served only through stream.php (auth + Range); the
# quiz/caption sources only through their endpoints. Direct URLs would
# bypass login entirely.
RedirectMatch 404 ^/videos/

# App internals — nothing under these is meant to be fetched.
RedirectMatch 404 ^/includes/
<FilesMatch "^(config\.php|config\.example\.php|schema\.sql|\.install\.lock|\.gitignore)$">
    Require all denied
</FilesMatch>