RewriteEngine On

# Keep the DB + master key out of the web path (defence-in-depth; the
# Apache doc-root should already be the project root, not /data).
RewriteRule ^data(/|$) - [F,L]

# Everything else funnels through index.php so route dispatch is
# centralised. Actual files (ui/style.css, etc.) continue to be
# served directly.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^ index.php [L]