diff --git a/.htaccess b/.htaccess
index 71c5a9f..132464b 100644
--- a/.htaccess
+++ b/.htaccess
@@ -10,6 +10,13 @@
 	Deny from all
 </Files>
 
+# This denies access to all yml files, since developers might include sensitive
+# information in them. See the docs for work-arounds to serve some yaml files
+<Files *.yml>
+	Order allow,deny
+	Deny from all
+</Files>
+
 ErrorDocument 404 /assets/error-404.html
 ErrorDocument 500 /assets/error-500.html