Hidden files (.env, .htaccess)

Show hidden files in your SFTP client when debugging. Never leave .env downloadable from the web root; keep secrets non-public.