# Defense in depth: no PHP execution under /assets.
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>
