Deny access to .env

.htaccess

@@ -12,3 +12,9 @@ Options -Indexes
 
 #   Serve JSON documents with the correct MIME types
 AddType application/activity+json .json
+
+# Deny access to env file because it contains secrets
+# See https://httpd.apache.org/docs/2.4/en/mod/mod_authz_core.html#reqall
+<Files .env>
+    Require all denied
+</Files>