# Block direct web access to the .git directory and other dotfiles.
# The .git folder lives inside public_html (docRoot) and was found to be
# directly downloadable over HTTPS (e.g. https://orbis.orbishosting.com/.git/config),
# which leaked a live GitHub personal access token embedded in the remote URL.
RedirectMatch 404 /\.git

<FilesMatch "^\.">
  Require all denied
</FilesMatch>