# Deny direct HTTP access to uploaded person photos.
# Photos must be served exclusively through the authenticated API endpoint:
#   GET /api/person/{personId}/photo
# See: GHSA-r286-h493-ppwj

Require all denied
