# Block direct web access to the local config (contains secret key).
<Files "config.local.php">
  Require all denied
</Files>

# Allow the API entry point and the example config.
<FilesMatch "^(index\.php|lib\.php|config\.example\.php)$">
  Require all granted
</FilesMatch>

# Block raw access to the package catalog (served via the API instead).
<Files "packages.json">
  Require all denied
</Files>
