Options -Indexes

# Protect server-side credentials and transaction records.
<FilesMatch "^(config\.php|\.env|\.env\..*)$">
  Require all denied
</FilesMatch>

<FilesMatch "^txn_[a-f0-9]+\.json$">
  Require all denied
</FilesMatch>

<FilesMatch "^(server\.js|package\.json|README.*|.*\.log)$">
  Require all denied
</FilesMatch>
