# This folder only ever holds uploaded KYC documents (Aadhaar/PAN/GST/Trade
# License — images or PDFs). Disable script execution here as
# defense-in-depth, in case a malicious file ever ends up with a
# misleading extension.

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.(php|php\d|phtml|pl|py|cgi|sh)$">
    Require all denied
</FilesMatch>

Options -Indexes
