diff --git a/.htaccess b/.htaccess
index 5b543ec..ed30591 100644
--- a/.htaccess
+++ b/.htaccess
@@ -16,8 +16,11 @@ RewriteBase /
 # Block access to version control metadata and the raw DB schema dump.
 # These were previously reachable directly over HTTP (e.g. /.git/config,
 # /db/schema.sql) and leaked repo/DB internals - deny them outright.
-RewriteRule ^\.git(/|$) - [F,L]
-RewriteRule ^db/ - [F,L]
+# Note: a direct RewriteRule pattern (no leading slash) was found NOT to be
+# honored consistently on this LiteSpeed setup for root-level paths; matching
+# on REQUEST_URI via RewriteCond is what's confirmed to work.
+RewriteCond %{REQUEST_URI} ^/(\.git|db/)
+RewriteRule .* - [F,L]
 
 # API Routes - Direct to PHP backend
 RewriteCond %{REQUEST_URI} ^/api/
diff --git a/api/.htaccess b/api/.htaccess
index 84e679f..a04bdce 100644
--- a/api/.htaccess
+++ b/api/.htaccess
@@ -8,7 +8,10 @@
     # Block direct access to config.php / .env - this was reachable at
     # /api/config.php in production (200 OK) despite the FilesMatch/Require
     # rule below, which LiteSpeed appears not to honor from .htaccess here.
-    RewriteRule ^(config\.php|\.env)$ - [F,L]
+    # Matching on REQUEST_URI (not a direct RewriteRule pattern) is what's
+    # confirmed to actually work on this LiteSpeed setup.
+    RewriteCond %{REQUEST_URI} /(config\.php|\.env)$
+    RewriteRule .* - [F,L]
 
     # Route all requests to index.php
     RewriteCond %{REQUEST_FILENAME} !-f