I noticed that the ping app and "unknown" project app configurations always fell back to a development configuration. So when hitting an unknown endpoint (e.g. example.com/test) which would be routed via the unknown-project app, the response would contain details that should probably be kept private, such as PHP file paths and such. This is since these apps still use the regular error handlers, which return more information when in development configuration.

It looks like it was the intention for these two apps to default to a production configuration, but because the env had been placed in an object called app instead of the root, the error handling code couldn't find it where it expected it, and therefore defaulted to "development".

As a side note, it looks like there are a few places in the codebase that default to development e.g. ->get('env', 'development'). Perhaps these should default to production to be on the safer side?

Before fix:

After fix: