Information Disclosure of .htaccess file in Private Server/Subdomain

Summary

@ahsantahir reported a missing permission check on an internal service allowing the extraction of the .htaccess file. We've fixed this by adjusting the Apache configuration and putting Basic Auth in front of the page.

On request of the reporter this is disclosed limitedly.

Non-Critical, small Information Disclosure. :-)