# Profile pictures and certificates are private application data. They must be
# served through the authorized /files/legacy/{file} controller route.
Require all denied

# The institution logo is an intentional public branding asset used by login.
<Files "psmza.png">
    Require all granted
</Files>
