<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block access to hidden files and directories (starting with a dot, except .well-known)
    RewriteRule "(^|/)\.(?!well-known)" - [F]

    # Block sensitive files directly
    <FilesMatch "(^\.env|composer\.(json|lock)|package(-lock)?\.json|phpunit\.xml|README\.md|artisan)">
        Order allow,deny
        Deny from all
    </FilesMatch>

    # Send all requests to the public directory
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L,QSA]
</IfModule>
