apikey 2.2.0

i used docker-compose.yaml and .env files to locally host appwrite
on locally hosted instance
unauthenticated curl get of v1/account can leak the entire project
appwrite.io does not return the same response
attached are the modified docker files

simple
curl -X GET 'https://login.example.com/v1/account' -H 'X-Appwrite-Project: proj'
returned the entire project

edited the .env to hide the host name

apikey 2.2.0

two jsons
one with the project specified
the other curl without specifying the project name

i think you have a debug variable enabled, as on my instance i tried the same curl and the file isn't even showing

prob because you have _APP_ENV is development

instead of prod

i will try that

you're correct
changing it to
_APP_ENV=production
returned the expected results
{"message":"User (role: guests) missing scopes (["account"])","code":401,"type":"general_unauthorized_scope","version":"2.2.0"}
thanks for pointing that out