Options -Indexes -MultiViews
DirectoryIndex index.html
RewriteEngine On
RewriteRule (^|/)\. - [F,END]
RewriteRule ^(?:private|ops|tests|node_modules)(?:/|$) - [F,END,NC]
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteRule ^api/([A-Za-z0-9/_-]+)$ api.php?route=$1 [END,QSA]
<FilesMatch "^(?:package.*\.json|AGENTS\.md|DEPLOYMENT\.md|README\.md|.*\.(?:env|log|mjs|sh|ps1|bak))$">
  Require all denied
</FilesMatch>
<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set X-Frame-Options "DENY"
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Embedder-Policy "credentialless"
  Header always set Permissions-Policy 'camera=(), microphone=(), geolocation=(), payment=(), cross-origin-isolated=(self "https://cotiza.18-224-95-47.sslip.io")'
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-src https://cotiza.18-224-95-47.sslip.io; frame-ancestors 'none'"
  <FilesMatch "\.(?:html|js|css)$">
    Header set Cache-Control "no-cache"
  </FilesMatch>
</IfModule>
