# Phase 8.0 security triage.
#
# common/ holds include-only files: the database bootstrap (library.php),
# the shared SQL helpers (helper.php, blog_helper.php) and the
# authentication guard added in Phase 8.0. None of them is an endpoint.
#
# helper.php in particular reveals the query patterns and table structure of
# the whole application, and foreign_relation() echoes SQL when executed.
# PHP includes these from the filesystem, which this rule does not affect.

<IfModule mod_authz_core.c>
    # Apache 2.4
    Require all denied
</IfModule>

<IfModule !mod_authz_core.c>
    # Apache 2.2
    Order allow,deny
    Deny from all
</IfModule>
