You get the best of both worlds by putting your config in the webroot with a defined name (I use .htinclude) and then use Include statements in the VirtualHost definition. Your deployment script can do this for you. Out of the box, Apache won’t serve any file beginning “.ht” so it’s not a security risk.