diff --git a/.github/workflows/fresh-install-test.yml b/.github/workflows/fresh-install-test.yml
index dfcb28ee..76caa01e 100644
--- a/.github/workflows/fresh-install-test.yml
+++ b/.github/workflows/fresh-install-test.yml
@@ -50,4 +50,7 @@ jobs:
         DB_DATABASE: testing_db
         DB_USERNAME: root
         DB_PASSWORD: secret
-      run: php artisan migrate --seed && php artisan test
+        OPENKAB_DB_DATABASE: testing_gabungan_db
+        OPENKAB_DB_USERNAME: root
+        OPENKAB_DB_PASSWORD: secret
+      run: php artisan key:generate && php artisan migrate --seed && php artisan test
diff --git a/public/.htaccess b/public/.htaccess
index 2106ca4f..49447f19 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -5,6 +5,10 @@
 
     RewriteEngine On
 
+    # Block access to dotfiles (including .env)
+    RewriteCond %{REQUEST_URI} ^/\.env [NC]
+    RewriteRule ^ - [R=404,L]
+
     # Handle Authorization Header
     RewriteCond %{HTTP:Authorization} .
     RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
@@ -29,3 +33,17 @@
     Order Allow,Deny
     Allow from all
 </Files>
+
+# Block direct access to .env and other dotfiles
+<FilesMatch "^\.env">
+    Require all denied
+</FilesMatch>
+
+# Fallback for Apache 2.2
+<IfModule !mod_authz_core.c>
+    <FilesMatch "^\.env">
+        order allow,deny
+        deny from all
+        Satisfy All
+    </FilesMatch>
+</IfModule>