# Le Voyage CRM middleware
Options -Indexes

# config.php holds SHARED_SECRET and the Klaviyo private key.
<Files "config.php">
    Require all denied
</Files>

# Never serve queue or log data over HTTP.
<FilesMatch "\.(jsonl|log|lock|md)$">
    Require all denied
</FilesMatch>

# Library classes are includes, not endpoints.
RedirectMatch 403 ^/lv-crm/lib/.*$

<IfModule mod_headers.c>
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "DENY"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>
