# Voice notes are stored here as plain audio files with random UUID
# filenames (see session/voice-note.php). Defense in depth: even though
# we tightly control the extension on write, never let anything in this
# folder execute as PHP, and never let anyone browse it.
Options -Indexes
<FilesMatch "\.(php|phtml|php\d?|pl|py|cgi|sh)$">
  Require all denied
</FilesMatch>
php_flag engine off
