Step 1
RequiredCreate server config
Copy /api/config.local.php.example to /api/config.local.php inside Hostinger and paste the real values there only.
api/config.local.php resend_api_key supabase_url supabase_anon_key cron_secret
UpTime Invoice ProPrivate Core V17.2 · Service Studio Nivel Dios
Production Security
Print Layout Pro
Private deploy guide for server-side secrets, API protection, cron safety and clean production files.
ReleaseV17.2
FocusSecurity
SecretsServer config
DeployControlled
Step 2
IncludedProtect API config
Upload /api/.htaccess. It blocks direct access to config files, helper files and backup/log files inside the API folder.
api/.htaccess api/_bootstrap.php api/config.local.php.example
Step 3
Manual mergeRoot protection
Use htaccess-security-snippet.txt as a guide. Merge it into your current public_html/app/.htaccess after taking a backup.
Do not blindly replace .htaccess. Back up first. Merge only the security rules you need.
Step 4
ImportantRotate exposed keys
Any server key previously pasted in PHP or shared in a chat should be rotated in the provider dashboard, then stored only in config.local.php.
Rotate Resend key Confirm cron secret Confirm Supabase RLS remains active