Options -Indexes
RewriteEngine On

# Block direct access to app folder
RewriteRule ^app/ - [F,L]
RewriteRule ^database/ - [F,L]

# Serve real files/folders directly (assets, uploads)
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]

# Everything else goes through the front controller
RewriteRule ^ index.php [L]
