# Deny all direct web access to JSON data files (Apache).
# NOTE: The PHP built-in server ignores .htaccess — use a real Apache/Nginx host in production.
Require all denied
<IfModule !mod_authz_core.c>
  Order allow,deny
  Deny from all
</IfModule>
