# .htaccess: the PHP classes of the application are never served over HTTP (the index.php of the parent folder loads them from disk).
# On nginx this file has no effect; every file of this folder then protects itself with its KNOCK_KNOCK_ROOT guard. The files of the library in vendor/ have no such guard, so for them this file is the only protection:
# the protection test of the application (Onboarding\ProtectionCheck) puts a canary file into this folder and reports the installation as exposed when the server serves it.
# @comments-complete 2026-11-05

# Fails closed: without mod_authz_core (Apache 2.4) the server answers 500 instead of serving the files.
Require all denied
