Public default `_APP_OPENSSL_KEY_V1` enables forged authentication tokens

### 👟 Reproduction steps # Public default `_APP_OPENSSL_KEY_V1` enables forged authentication tokens ## Summary This issue reports a publicly known default signing key in Appwrite self-hosted deployments. Appwrite publishes `_APP_OPENSSL_KEY_V1=your-secret-key` in the repository `.env` file. The same symmetric key is used as the HS256 trust root for multiple externally supplied token formats. In a self-hosted deployment that retains this published value, an attacker who knows a project ID and a valid user ID can forge an `X-Appwrite-JWT` without a session. The attacker can also forge a project-level `ephemeral_` API key with attacker-selected scopes. The latest source audit found two additional consumers of the same key: realtime JWT authentication and the unauthenticated file-push URL path. This is conditional on the deployment retaining the published key. It is not a claim that every Appwrite deployment is affected. The installer has a secure random-key generation path, but the public fallback remains directly usable, and the current Doctor task only warns instead of refusing to start. We first submitted this issue privately to `security@appwrite.io` on 2026-08-26. After more than 20 days without an acknowledgement or substantive response, we are opening this issue so that the maintainers can review the evidence and track a fix. We are reporting it in good faith and have limited the proof of concept to local, isolated testing with placeholders. ## Affected paths identified in the audit Repository: [`appwrite/appwrite`](https://github.com/appwrite/appwrite) Latest audited commit: [`f61009be8c769ae705f6f08b6c0944fb97ab0a84`](https://github.com/appwrite/appwrite/commit/f61009be8c769ae705f6f08b6c0944fb97ab0a84) | Affected path | Finding | Validation status | | --- | --- | --- | | `X-Appwrite-JWT` | `sessionId` is optional; the server loads the user from JWT `userId` after verifying only the global HS256 signature | Dynamically reproduced in the original isolated depl…