# AppShot Studio — public upload store guard.
#
# This directory holds user-uploaded images (project screenshots, branding,
# theme/kit assets) and generated thumbnails. Files are served directly by the
# webserver under UUID-randomised filenames — there is no per-request app-level
# auth (these are capability URLs: knowing the URL grants access).
#
# Disabling directory listing is the confidentiality control: the random UUID
# filenames can't be enumerated by walking a project folder, so an attacker who
# guesses a (sequential) project id still can't discover the files inside it.
#
# The parent public/.htaccess also sets -Indexes, but only inside an
# <IfModule mod_negotiation.c> block; this is the unconditional guarantee.
# Wrapped in mod_autoindex so it only emits where listing is even possible
# (degrades cleanly on hosts without the module — no "Options not allowed" 500).
<IfModule mod_autoindex.c>
    Options -Indexes
</IfModule>
