big

config/.htaccess

@@ -0,0 +1,7 @@
+<IfModule mod_authz_core.c>
+    Require all denied
+</IfModule>
+
+<IfModule !mod_authz_core.c>
+    Deny from all
+</IfModule>

config/config.php

@@ -1,6 +1,12 @@
 <?php
 declare(strict_types=1);
 
+// Local server secrets live outside the public webroot and are never committed.
+$localSecrets = __DIR__ . '/secrets.local.php';
+if (is_file($localSecrets)) {
+    require_once $localSecrets;
+}
+
 // Basic error reporting (keep strict in dev)
 ini_set('display_errors', '1');
 ini_set('display_startup_errors', '1');

config/secrets.local.php.example

@@ -0,0 +1,13 @@
+<?php
+declare(strict_types=1);
+
+// Copy this file to config/secrets.local.php and replace the placeholders.
+// Never commit config/secrets.local.php or place it inside public/.
+
+if (getenv('GOOGLE_MAPS_API_KEY') === false) {
+    putenv('GOOGLE_MAPS_API_KEY=replace-with-your-google-server-key');
+}
+
+if (getenv('AZURE_MAPS_SUBSCRIPTION_KEY') === false) {
+    putenv('AZURE_MAPS_SUBSCRIPTION_KEY=replace-with-your-azure-maps-key');
+}