Deny requests to .lock files (as in composer.lock)