<FilesMatch "\.(ya?ml|env)$">
  Require all denied
</FilesMatch>