# private/ holds config, secrets-vault storage, and PHP source classes —
# never web-accessible. This is a belt-and-suspenders safety net: the real
# protection is that cPanel's document root points at public/, not here.
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order deny,allow
  Deny from all
</IfModule>
