# Block all direct web access to this directory and everything under it
# (data/debug/ holds raw copies of every uploaded MT5 statement — real
# account numbers, broker names, and trade history — written by
# api/mt5/parse.php with a predictable date/time-based filename and, until
# this file existed, served directly by Apache to anyone who requested it,
# with no authentication at all). Blocking this at the web-server level
# does not affect the MT5 upload/parse feature itself, which reads the
# uploaded file from PHP's own temp location and never serves anything
# from this directory back to the browser.
#
# Apache 2.4+
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Apache 2.2 fallback
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
