cat > .htaccess <<'EOF'
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Protect sensitive Laravel files
    <FilesMatch "^(\.env|composer\.json|composer\.lock|artisan|server\.php)$">
        Require all denied
    </FilesMatch>

    # Send all requests to public folder
    RewriteCond %{REQUEST_URI} !^/public/
    RewriteRule ^(.*)$ public/$1 [L]
</IfModule>
EOF