Options -Indexes
DirectoryIndex index.php

RewriteEngine On

# Bloqueia banco de dados, includes e arquivos internos.
RewriteRule ^(?:storage|includes)(?:/|$) - [F,L,NC]
RewriteRule ^(?:RELATORIO_ANALISE\.md|README\.md)$ - [F,L,NC]

# Mantém arquivos e páginas reais acessíveis; as rotas virtuais vão para index.php.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [QSA,L]

<IfModule mod_headers.c>
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "same-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>
