<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block direct access to Laravel source files (security)
    RewriteRule ^(app|bootstrap|config|database|resources|routes|storage|vendor)(\/.*)?$ - [F,L]
    RewriteRule ^(\.env|artisan|composer\.(json|lock))$ - [F,L]

    # Route everything through Laravel's public/ folder
    # URL stays clean — /public never shows in browser
    RewriteRule ^$ public/index.php [L]
    RewriteRule ^((?!public/).*)$ public/$1 [L,QSA]
</IfModule>