<IfModule mod_rewrite.c>
  RewriteEngine On

  # Block direct access to subfolders to prevent browsing/leaking classes
  RewriteRule ^(Config|Controllers|Core|Helpers|Middleware|Models|Routes|Services|Tools|Traits|config|controllers|core|helpers|models|services)(/|$) - [F,L]

  # Route all requests to api/index.php (the API dispatcher)
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule ^(.*)$ index.php [QSA,L]
</IfModule>

Options -Indexes
