RewriteEngine On

# Deny access to dotfiles (.env, .git, etc.)
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Route everything except real files/dirs (and /public assets) through index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

# Never allow direct execution of PHP inside storage/ or config/
<IfModule mod_php.c>
    <FilesMatch "\.php$">
        SetHandler application/x-httpd-php
    </FilesMatch>
</IfModule>
