Due to circumstances beyond my control, I must include sensitive information (database password) in a web-accessible directory. Furthermore, this host has already had a configuration issue in which .php files were served without parsing.
Which files will Apache under no circumstances ever serve from within the web root, even in the event of misconfiguration. Casual googling leads me to believe that any file that begins with the string
.ht will never be served, but as I have no way of testing this I'd like the opinion of those more familiar with the subject than I.
Note that moving to a different server / host is not an option. Sometimes we don't live in a perfect world and must do with what we have.