# VulnLab — basic hardening for core paths (labs remain intentionally open)
<IfModule mod_authz_core.c>
  <FilesMatch "^(config\.php|schema\.sql|seed\.sql)$">
    Require all denied
  </FilesMatch>
</IfModule>

# Deny access to sensitive directories
RedirectMatch 403 (?i)/config/
RedirectMatch 403 (?i)/database/
RedirectMatch 403 (?i)/storage/ratelimit/
RedirectMatch 403 (?i)/\.git

# Limit request methods on platform (labs may use GET/POST)
<IfModule mod_rewrite.c>
  RewriteEngine On
  # Block very long query strings (DoS)
  RewriteCond %{QUERY_STRING} .{2000,}
  RewriteRule .* - [F,L]
</IfModule>
