DEV Community

kozhevniko
kozhevniko

Posted on

Gitea at 117,523 and n8n at 420,452: The Self-Hosted Layer That Holds Your Credentials

#gitea #n8n #selfhosted #secretsmanagement

Gitea at 117,523 and n8n at 420,452: The Self-Hosted Layer That Holds Your Credentials

Source control and workflow automation have something specific in common. Both are built to remember secrets on behalf of other systems, and both are frequently published to the internet so that distributed teams and webhooks can reach them.
ZoomEye measurements collected on 28 October 2026 show 117,523 assets matching app="Gitea", 420,452 matching app="n8n" and 401,268 matching title="n8n". Those are counts of indexed assets that identify with each product. They are not counts of exposed secrets, and the difference between the two is where the operational work sits.

What these two systems store

A Gitea instance holds repositories, and repositories hold whatever developers committed. It also holds deploy keys, webhook secrets, access tokens and, in many installations, the SSH keys used to push code. An n8n instance holds workflow definitions that connect to external services, which means API credentials for those services sit inside the workflow configuration.
Both products therefore concentrate value that has nothing to do with the application itself. Compromising either does not just yield a login; it yields the set of credentials the platform was trusted with. That is the reason a public instance deserves more scrutiny than the asset count suggests, and the reason the counts deserve less alarm than a headline would give them.

The settings that decide the outcome

Gitea publishes a configuration cheat sheet with a security section, and three of its entries describe the difference between a hardened instance and an open one.
INSTALL_LOCK controls access to the installation page; when set to true, that page is no longer reachable. An instance that was set up and never locked still presents its initial configuration screen, which is an unnecessary invitation.
SECRET_KEY is generated at random on every install and the documentation is emphatic about its importance: data encrypted with it, including two-factor secrets, cannot be decrypted if it is lost. A key that was copied between environments to make migration easier weakens that guarantee everywhere it was copied.
DISABLE_REGISTRATION defaults to true in the documented configuration, and when enabled only administrators can create accounts. The failure mode here is familiar: a registration page left open on an instance that was meant for a small team, discovered later when unfamiliar accounts appear in the user list.
For n8n, the relevant surface is the administrative one. The n8n documentation separates deployment and configuration from workflow building, and the configuration area includes instance owner management and user administration. An instance where every visitor can create an account, or where the owner account still uses the address set during setup, has delegated its credential custody to whoever finds it first.

Why the fingerprints differ so much from each other

Gitea at 117,523 and n8n at 420,452 is a wide spread for two self-hosted tools. Part of it reflects adoption: workflow automation spread quickly because it solves an immediately visible problem, while self-hosted Git appeals to organisations with a specific reason to keep code on their own hardware.
Part of it reflects deployment shape. An n8n instance has to be reachable by webhooks from external providers, which pushes it toward a public address. A Gitea instance can be reached through a VPN by its developers, which lets it stay private. The count is therefore shaped by architecture as much as by popularity.
For n8n the title match and the app match are close, 401,268 against 420,452, which suggests the fingerprint and the page title agree on most indexed assets. For Gitea there is no comparable second signal in this measurement, so the 117,523 figure should be treated as a floor rather than a census.

A review sequence that takes an hour

Confirm the version and the registration policy first. On Gitea, check INSTALL_LOCK, DISABLE_REGISTRATION and whether REQUIRE_SIGNIN_VIEW is set for instances that should not be browsable anonymously. On n8n, check whether user management is enabled and who holds the owner account.
Then enumerate what the instance can reach. For Gitea, list deploy keys and webhook targets; a stale key from a departed contractor is a finding that no scanner will report. For n8n, list the credentials attached to active workflows and confirm each one is still needed. Automation platforms accumulate connections because removing one risks breaking a process nobody remembers writing.
Finally, decide whether the instance should be public at all. A repository server that only serves a known set of developers does not need to answer the open internet, and an automation platform can often be reached through a reverse proxy that terminates at a smaller set of allowed paths.

What the numbers cannot tell you

Neither 117,523 nor 420,452 says anything about configuration. An instance counted under app="n8n" may enforce single sign-on, restrict registration to an allowlist of domains and log every login, or it may be a default installation that somebody started to evaluate in 2024 and never removed. The fingerprint identifies the software; only an internal check identifies the posture.
The other limitation is deduplication. A single organisation may publish several instances, and a hosting provider may run hundreds behind one domain pattern. Aggregate counts mix both, so a share-of-population argument built on them will be approximate.
What survives is the specific point. These two platforms are worth counting because of what they hold rather than because of how many there are, and the settings that decide whether the holding is safe are documented, named and checkable in a single session.

References

Top comments (0)