# Security Audit Patch — 2026-06-22

Applied hardening changes:

1. Removed exposed PHP backup files from `public/dist/`.
2. Added `public/dist/.htaccess` to deny PHP execution in the static asset directory.
3. Added a `public/.htaccess` rewrite deny rule for `dist/*.php` before real-file passthrough.
4. Changed `public/redirect-decision.php` to require explicit `RD_PASSWORD_HASH` in `.env`; the static fallback hash was removed.
5. Removed an environment-specific cPanel `error_log` filesystem path from root `.htaccess`.
6. Replaced environment-specific domains in `auth.md` with `example.com` placeholders.

Deployment note:

Generate `RD_PASSWORD_HASH` before enabling `redirect-decision.php`:

```bash
php -r "echo password_hash('REPLACE_WITH_STRONG_PASSWORD', PASSWORD_BCRYPT, ['cost'=>12]), PHP_EOL;"
```

Then set this in `.env`:

```env
RD_PASSWORD_HASH=<generated_hash>
```
