DEV Community

OnaEiuspkz
OnaEiuspkz

Posted on

Gitea servers on the internet: 115,944 fingerprint matches and 66,857 on port 3000

#sourcecode #gitea #exposuremanagement

Gitea servers on the internet: 115,944 fingerprint matches and 66,857 on port 3000

Source code as the shortest route to production

A self-hosted Git service holds the code, the pipeline definitions, the deployment credentials in continuous integration variables, and often the internal documentation. Reaching one is not a step towards production access; depending on configuration, it can be most of that access.
Gitea is popular precisely because it is small and easy to run, which is also why it appears in environments that have no formal inventory process around it.

What was queried

Three queries against ZoomEye on 2026-09-26 (UTC), Python SDK, sub_type=all, page size one:

  • app="Gitea": 115,944
  • title="Gitea": 119,972
  • app="Gitea" && port=3000: 66,857

Two queries that agree, and one that does not

The fingerprint and the title query agree within four per cent, 115,944 against 119,972. Convergent estimates from independent fields are a reasonable basis for a population figure, and in this case they suggest the measurement is stable.
The intersection with port 3000 returns 66,857, which is fifty-eight per cent of the fingerprint population. Unlike the Airflow case, a majority of identified instances answer on the project's documented default port. The remaining instances are on 443 through a proxy, on a shared port, or on a custom configuration, and they are invisible to a port-based inventory.

What matters for these systems

  1. Registration policy. An instance that permits self-registration allows anyone who reaches it to create an account, and account creation is frequently followed by the ability to read repositories that were assumed to be private.
  2. Repository visibility defaults. The difference between an organisation's assumption and the instance's configuration is the most common serious finding.
  3. Continuous integration secrets. Pipeline variables are the deployment credentials. Their scope, their protection rules, and the log masking behaviour are configuration decisions that should be reviewed rather than inherited.
  4. Administrative separation. The administrative account and the automation account should be different identities with different authentication methods. Vendor documentation covers the configuration surface, including authentication and the configuration file reference.

Limitations

Counts describe matched assets at collection time. They do not indicate version, registration policy, or repository visibility. A Gitea instance on a corporate network without external access is not represented in these figures, and no count establishes that any instance permits anonymous access.

References

Top comments (0)