# Uploaded receipts should only ever be served through an authenticated
# controller action that checks the requester belongs to the right business
# — never accessed directly by guessable URL.
Options -Indexes

<FilesMatch "\.(php|phtml|php3|php4|php5|php7)$">
    Require all denied
</FilesMatch>
