HostDesk emergency source protection (cPanel/LiteSpeed/Apache)

1) DELETE/MOVE every hostdesk-panel*.zip, *.rar, *.7z, SQL dump and backup copy OUTSIDE public_html.
2) Keep the .htaccess supplied with this release. Do not rename/delete it.
3) Best deployment: set DocumentRoot to /path/to/hostdesk/public and keep the project root outside public_html.
4) If the whole project must remain under public_html, confirm these URLs return 403/404:
   /app/
   /app/bootstrap.php
   /database/
   /storage/
   /cron/
   /modules/
   /docs/
   /public/
   /hostdesk-panel-v2.1.5.zip  (or any real archive name)
5) Disable directory indexes in cPanel/Apache/LiteSpeed.
6) If .htaccess rules are ignored, ask the host/server admin to enable AllowOverride or add equivalent vhost rules. Application RBAC cannot protect raw files served directly by the web server.
