<FilesMatch "^\b(?!pub.*).*$">
    Require all denied
</FilesMatch>
