Block access to txt and php files, except index.php and Robots.txt

I am very new to platform sh, I want to know that how can we block direct access to txt and php files except index.php and Robots.txt.

We are running some security scan a project. we actually want to block access to all .txt (Except one, Robot.txt) and .php (except one, index.php) files on the Website,
By Searching online, i came to know that it will be somehow controlled from the .platform.app.yaml file but not sure how to create rules. Can anybody help ?

Thanks & Regards,