<Files db.php>
  Order deny,allow
  Deny from all
</Files>

RewriteEngine On
RewriteRule ^db\.php$ - [F,L]
RewriteCond %{REQUEST_URI} ^/db\.php$
RewriteRule .* - [F,L]

# .git/ was found directly downloadable (leaked GitHub PAT) - same class of
# issue found and fixed on sibling sites this session.
RewriteCond %{REQUEST_URI} ^/\.git
RewriteRule .* - [F,L]

# uploads/ (customer license/insurance docs) must never be directly downloadable -
# same Order/Deny-doesn't-work-on-OpenLiteSpeed gotcha as .git above. Docs are
# served only through view-doc.php / admin/view-doc.php, which read by filesystem
# path via readfile() - blocking direct URL access here doesn't break that flow.
RewriteCond %{REQUEST_URI} ^/uploads/
RewriteRule .* - [F,L]