# Deny direct access to package root — traffic must go through /public/
<FilesMatch ".*">
    Require all denied
</FilesMatch>
