Issue #2854817 by Liam Morland, longwave, alexpott, JoshaHubbers, effulgentsia, alex-b, Mile23, thalles, mr.baileys, Wim Leers, xjm: Duplicate X-Content-Type-Options headers both with the value nosniff

Issue #3327115 by Eric_A, alexpott, xjm, longwave, pandaski: .htaccess rules broken since yarn.lock got added

Issue #1040534 by catch, Owen Barton, danreb, mikeytown2, ogi, omega8cc, xjm: Rewrite rules for gzipped CSS and JavaScript aggregates cause lots of lstats for files that will never exist

Issue #3079404 by anavarre: Document that .htaccess 301s get the ExpiresDefault value of 2 weeks instead of the Drupal value

Issue #2455465 by stefan.r, Darren Oh, cosmicdreams, longwave, benjy, alexpott: Add mod_php7 check to htaccess and remove php5 code

Issue #2948579 by greggles, mcdruid, longwave, Chi, rabbitlair, alexpott, DKAN, beckydev, interX, sammuell: Block web.config in .htaccess (and vice-versa)

Issue #2408321 by mfb, sanduhrs, D34dMan, C_Logemann, xumepadismal, John Morahan, serg2, walterebert, David Grudl: Support RFC 5785 by whitelisting the .well-known directory

SA-CORE-2016-003 by alexpott, Michael Dowling, mlhess, xjm, Pere Orga, dawehner, greggles, coltrane, pwolanin, larowlan

Issue #2408321 by mfb, D34dMan, C_Logemann, serg2, walterebert, sanduhrs, John Morahan: Support RFC 5785 by whitelisting the .well-known directory

Issue #2392153 by mparker17, hussainweb, chris.smith, alexpott, dawehner: Disallow composer.json and composer.lock from being indexed

Issue #1269780 by hswong3i, damien_vancouver, Agileware, ricardoamaro, alexpott, axel.rutz, yannickoo: Remove symlinks option from .htaccess

Issue #2382513 by mikeker, chris_hall_hu_cheng, joachim, joelpittet, alexpott, YesCT, quietone, mikeker, Jeroen, joris_lucius, katy5289, sivaji@knackforge.com: Regression fix: allow Drupal 8 to work without Apache mod_rewrite

Issue #2408013 by Aki Tendo, alexpott, Fabianx, dawehner, Crell, jhodgdon, Wim Leers, aspilicious: Adding Assertions to Drupal - Test Tools

Issue #2508666 by alexpott, pwolanin, benjy: Drupal 8 .htaccess rule to prevent php file access can be easily bypassed

Issue #2279105 by mgifford, nidaismailshah, thedavidmeister, amitgoyal, rpayanm, ameenkhan07, rakhimandhania, jhodgdon: Remove as many "..." and ellipsis characters from the codebase as possible without altering the meaning of text

Issue #2456025 by stefan.r, alexpott, klausi: Rest tests fail on PHP 5.6 because of always_populate_raw_post_data ini setting

Issue #2406681 by tstoeckler, hussainweb, alexpott, ParisLiakos, almaudoh, tadityar: Add an autoload.php in the repo root to control the autoloader of front controllers

Issue #462950 by pwolanin: Mitigate the security risks that come from IE and other browsers trying to sniff the mime type

Issue #1956698 by Gábor Hojtsy, xjm, alexpott, damiankloip, mgifford: Prevent access to YAML files using .htaccess and web.config.

Issue #1587270 by klausi, greggles, sun: Forbid execution of PHP files in subfolders by default (except those needed by core).

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Revert "Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel."

This reverts commit cda051c4.

Issue #2016629 by larowlan, neclimdul, sun, alexpott, jibran, ParisLiakos, donquixote, effulgentsia, msonnabaum: Refactor bootstrap to better utilize the kernel.

Issue #1599774 by longwave, kristofferwiklund, BTMash, marcingy | Letharion: .htaccess protections do not work on Apache 2.4 without mod_access_compat.

Issue #1587270 by klausi: Added comment in .htaccess describing how to forbid execution of PHP files in subfolders.

Issue #1962780 by David_Rothstein, petyovsky: Fixed 500 Internal server error on Apache 1.x servers after updating to Drupal 7.22.