# College Attendance Management System — harden sensitive paths
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block direct access to config SQL and local overrides
    RewriteRule ^config/.*\.(sql|php\.example)$ - [F,L]
    RewriteRule ^config/database\.local\.php$ - [F,L]
    RewriteRule ^config/migrations/ - [F,L]
    RewriteRule ^schema/ - [F,L]
</IfModule>

# Fallback if mod_rewrite unavailable
<FilesMatch "\.(sql)$">
    <IfModule mod_authz_core.c>
        Require all denied
    </IfModule>
    <IfModule !mod_authz_core.c>
        Order deny,allow
        Deny from all
    </IfModule>
</FilesMatch>
