# StoneZero — route every request into /public so framework folders are never web-exposed.
Options -Indexes
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^$ public/ [L]
    RewriteRule ^((?!public/).*)$ public/$1 [L,NC]
</IfModule>
<FilesMatch "^\.env|composer\.(json|lock)|spark|\.pptx$">
    Require all denied
</FilesMatch>
