Deny composer.json and composer.lock in .htaccess

.htaccess

@@ -1,3 +1,7 @@
+<FilesMatch ^(composer\.(json|lock))$>
+    Deny from all
+</FilesMatch>
+
 RewriteEngine on
 
 #RewriteCond %{HTTPS} !^on$