Marquez appears across 831 titles while the application field finds three
Lineage metadata can reveal internal pipeline names and dataset relationships even when it never contains a row from a production table. Discovery therefore needs a careful response. On 2026-10-28 at 22:48 UTC, a bounded ZoomEye SDK probe used the global all scope, page 1, and page size 1. The query app="Marquez" returned 3. The query title="Marquez" returned 831.
The application matches are the tighter product leads. The title count includes pages whose title contains a common name and may have no connection to a lineage service. A team should not infer hundreds of Marquez deployments from the larger result. It should treat the app result as the first ownership queue and use page evidence to qualify title candidates.
The official Marquez deployment documentation states that its HTTP API requires no authentication or authorization by default. That is the security question behind discovery. A public API may expose lineage reads and accept producer writes. The measurement itself does not test either route, and sending events to an unowned server would be improper.
For each owned service, review the gateway, direct listener, health routes, producer endpoints, and analyst read paths. Put authenticated producer identities in front of write paths and a separate policy in front of reads. Network segmentation is valuable because the application's default assumes the operator has placed it in a controlled environment.
The Marquez UI is part of the same evidence boundary. A user who can read the API may be able to resolve dataset relationships in the UI. Compare the visual access policy with API access rather than assuming that the dashboard hides fields that the API returns.
Record source and producer ownership alongside the public host. OpenLineage events describe a producer, but an event name is not a credential. Bind the accepted producer to an approved workload or service identity, limit the namespaces and datasets it may write, and monitor unusual ingestion rates.
The three application matches make a focused review practical. The 831 title matches show why the broader query should remain a secondary observation with a clear caveat. ZoomEye can prioritize unknown lineage services and help a team create an owner list. It cannot tell whether an API returned pipeline names or accepted a forged event.
Top comments (0)