# Deny public access to the git working directory and legacy/unused
# server directories that live inside the web docroot but were never
# meant to be reachable over HTTP.
#
# Found during security review (2026-07): https://orbishosting.com/.git/config
# was directly downloadable and exposed a live GitHub PAT in the remote URL.
# That token must also be revoked/rotated on GitHub — this file only closes
# the HTTP exposure, it does not invalidate the leaked credential.
RewriteEngine On
RewriteRule ^\.git(/|$) - [F,L]
RewriteRule ^legacy(/|$) - [F,L]
RewriteRule ^dist(/|$) - [F,L]
RewriteRule ^extensions(/|$) - [F,L]
RewriteRule ^config(/|$) - [F,L]