# This directory holds secrets (config.php's constants, and — once placed —
# firebase_service_account.json's private key). Nothing in here is meant to
# be fetched directly; every file is `require_once`'d by scripts under api/.
# A .php file here would only execute silently if requested directly (no
# source leak), but a plain file like the Firebase JSON key would otherwise
# be served as raw static content — block the whole directory outright.
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Deny from all
</IfModule>
