Sorry, maybe I don't say clearly enough :(. Let show some code, hope it easy to understand. I found that, the order listing API doesn't work as expected. I sen

Sorry, maybe I don't say clearly enough :(. Let show some code, hope it easy to understand. I found that, the order listing API doesn't work as expected. I send the curl to my teammate. Please take a look at `-H 'X-Access-Token: SECRET_TOKEN' \` ``` curl 'https://mocha.lozi.vn/v6/users/me/orders https://mocha.lozi.vn/v6/users/me/orders' \ -X GET \ -H 'X-Access-Token: SECRET_TOKEN' \ -H 'Host: mocha.lozi.vn' \ -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:101.0) Gecko/20100101 Firefox/101.0' \ -H 'Accept: /' \ -H 'Accept-Language: vi_VN' \ -H 'Accept-Encoding: gzip, deflate, br' \ -H 'X-Lozi-Client: 1' \ -H 'X-City-ID: 50' \ -H 'Origin: https://loship.vn https://loship.vn' \ -H 'Connection: keep-alive' \ -H 'Referer: https://loship.vn/ https://loship.vn/' \ -H 'Sec-Fetch-Dest: empty' \ -H 'Sec-Fetch-Mode: cors' \ -H 'Sec-Fetch-Site: cross-site' ``` The problem is: 1/ If I don't replace the real token by SECRET_TOKEN, others can use it to buying their own stuffs, by my token. :( 2/ If I replace the real token by SECRET_TOKEN, it's so hard to detect what the problem is, cause my teammate can't see the response, and can't request to re-produce the issue too.