# PRIVATE — deny all direct HTTP access to app/ (code, config, secrets).
Require all denied
