# Block direct access to sensitive server-side files.
<FilesMatch "^(config|db|helpers)\.php$">
    Deny from all
</FilesMatch>

# Block access to lock file and any JSON data.
<FilesMatch "\.(json|lock|installed)$">
    Deny from all
</FilesMatch>
