# Block direct access to config.php and the _lib/ helpers — only the
# endpoint scripts (org/*.php, membership/*.php, etc.) should be reachable.
<FilesMatch "^config\.php$">
    Require all denied
</FilesMatch>

RewriteEngine On
RewriteRule ^_lib/ - [F,L]
