# 2026-08-19 security fix (pre-launch audit finding M-2): src/ is a pure
# internal library — every file here defines classes/functions meant only
# to be require_once'd by index.php or another PHP entry point, never
# requested directly over HTTP. Before this file existed, the root
# .htaccess's `RewriteCond %{REQUEST_FILENAME} !-f` meant any real file
# (including everything under src/) bypassed the front controller entirely
# and was served/executed directly by Apache. Confirmed live during the
# audit: a direct GET to src/Auth.php, src/ScopedDb.php, etc. returned 200
# (an empty body today, since these files have no top-level side effects —
# but nothing here structurally guarantees that stays true for every file
# added later, and with APP_ENV=development this also leaked full
# filesystem paths via PHP's own error output on any file that DID
# reference something undefined). Every real caller of these files reaches
# them via PHP's own require_once() at the filesystem level, which is
# completely unaffected by Apache-level access control — so this closes
# the direct-web-access gap with zero effect on the app's real behavior.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order deny,allow
    Deny from all
</IfModule>
