Options -Indexes

# Never expose deployment secrets, the SQLite database, or Python source/bytecode as static files.
<FilesMatch "^(\.env|\.env\..*|db\.sqlite3|.*\.(py|pyc|pyo|sqlite3|log))$">
    Require all denied
</FilesMatch>

# Block common hidden files/directories except ACME challenge files if the host uses them elsewhere.
<FilesMatch "^\.">
    Require all denied
</FilesMatch>
