# =============================================================================
# COMET — api/render/.htaccess
# =============================================================================
# This directory is a LIBRARY, not an endpoint. Every file in it defines
# functions and prints nothing; the two things that print — index.php at the
# install root and api/publish.php — include them from the filesystem, which
# no Apache rule can affect.
#
# Without this block each library answered a plain GET with an empty 200.
# MEASURED: `GET api/render/url.php` returned 200 with a zero-length body.
# Nothing leaked — but an empty 200 is a live URL, it tells a scanner the file
# is there, and it is one refactor away from a file that does print something.
# A library with a public address is a library waiting to be called.
#
# api/render/selfcheck.php refuses a web SAPI in its own first executable line
# as well. That is deliberate belt-and-braces: it renders attacker-supplied
# strings by design, so it must be unreachable even on a host that ignores
# .htaccess entirely.
#
# `Options -Indexes` is inherited from the install root, and repeated because
# inheritance is exactly the thing a parent .htaccess can take away.
Options -Indexes

<IfModule mod_authz_core.c>
  Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
</IfModule>
