# Brand assets (cards, icons, logo) are public — allow direct serving,
# but still deny any server-side scripting in this folder.
<FilesMatch "\.(php|phtml|phar|cgi|pl|py)$">
  Require all denied
</FilesMatch>
Options -Indexes
