diff --git a/server/api/documents.js b/server/api/documents.js
index 54590d1bc..9a02389b5 100644
--- a/server/api/documents.js
+++ b/server/api/documents.js
@@ -21,7 +21,7 @@ router.post('documents.info', auth({ require: false }), async (ctx) => {
 
   // Don't expose private documents outside the team
   if (document.private) {
-    // if (!ctx.state.user) throw httpErrors.NotFound();
+    if (!ctx.state.user) throw httpErrors.NotFound();
 
     const team = await ctx.state.user.getTeam();
     if (document.teamId !== team.id) {