Options -Indexes

# Defense-in-depth: api/upload.php already guarantees every file here is a
# freshly re-encoded image with a random name it chose itself (see that
# file's own docblock — no upload path can ever produce a .php file), but
# refusing to execute PHP in this directory at all means that stays true
# even if a future upload path is ever added here without the same care.
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<FilesMatch "\.ph(p[3457]?|t|tml)$">
    Require all denied
</FilesMatch>
