# Never serve secrets / templates
<FilesMatch "^config\.local(\.example)?\.php$">
  Require all denied
</FilesMatch>

# Service account keys and any other JSON secrets must never be downloadable.
<FilesMatch "\.json$">
  Require all denied
</FilesMatch>

# Not directly requested by browsers (internal libraries)
<FilesMatch "^(config|contribution_notify|fcm|push_notify|reminders_lib|webpush)\.php$">
  Require all denied
</FilesMatch>
