# DroidX cPanel deployment configuration
Options -Indexes
DirectoryIndex index.php

<IfModule mod_mime.c>
  AddType application/json .json
  AddType application/vnd.android.package-archive .apk
  AddType application/octet-stream .tflite
  AddType application/vnd.openxmlformats-officedocument.wordprocessingml.document .docx
  AddType application/pdf .pdf
</IfModule>

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Content-Security-Policy "default-src 'self' https://cdn.tailwindcss.com https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com; script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; img-src 'self' data: blob:; frame-src 'self'; connect-src 'self'; object-src 'self'"
</IfModule>

<IfModule mod_deflate.c>
  AddOutputFilterByType DEFLATE text/html text/plain text/css application/javascript application/json image/svg+xml
</IfModule>

# Protect JSON registries, archives and server-side scripts from directory-level access.
<FilesMatch "^(workspace_data|papers_metadata|droidshield_report|evaluation_metrics)\.json$">
  Require all denied
</FilesMatch>
<FilesMatch "\.(env|ini|log|bak|sql|sh)$">
  Require all denied
</FilesMatch>

# cPanel/PHP upload limits; align with the application-side 50 MB validation.
php_value upload_max_filesize 50M
php_value post_max_size 55M
php_value max_file_uploads 20
php_value max_execution_time 120
php_value max_input_time 120
