ShuckleOriginal post
Rank 1: Thread
i used docker-compose.yaml and .env files to locally host appwrite
on locally hosted instance
unauthenticated curl get of v1/account can leak the entire project
appwrite.io does not return the same response
attached are the modified docker files
simple
curl -X GET 'https://login.example.com/v1/account' -H 'X-Appwrite-Project: proj'
returned the entire project
Summary
An unauthenticated curl GET request can leak the entire project when using the API key 2.2.0 with locally hosted appwrite. The issue does not occur when using appwrite.io. A solution is to edit the .env file to hide the host name.