# bitrix24bridge: block ALL web access to the bridge runtime directory.
# This dir holds .env and config.yaml with JWT_SECRET, the FreePBX DB master
# password, and ARI/AMI/webhook secrets. It is the Node runtime only — nothing
# here is meant to be served by Apache. (Audit H3: secret exposure.)
<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order deny,allow
  Deny from all
</IfModule>
