# Protect sensitive PHP includes from direct browser access.
# API endpoints include them server-side; nobody should fetch them directly.
<FilesMatch "^(config|db)\.php$">
    Require all denied
</FilesMatch>
