# Block all direct web access to this directory. It holds append-only
# operational logs (email verification history, etc.) that must never be
# served over HTTP — some entries can include a real, still-usable
# verification token, which is auto-login-capable via /verify.
#
# Apache 2.4+
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>

# Apache 2.2 fallback
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
