How can I prevent Drupal’s public file system from exposing private configuration files accidentally?

I want to ensure that files placed in Drupal’s public file system are not unintentionally served to visitors when they contain sensitive information such as configuration exports or logs.

The site uses the default public file path defined in admin/config/media/file-system, and I am unsure whether additional server‑level restrictions are required to block access to files with extensions like .yml, .yaml, .inc, or .log.

What core settings should be reviewed to guarantee that only intended assets are served from the public file system? Are there recommended .htaccess rules or server‑level directives to block access to files with certain extensions? How can I verify that no private files are leaked after applying these changes?