OpenProject: compare title and app counts before mapping project servers

OpenProject supports project planning, work packages, wikis, meetings, and integrations. A public instance can expose project names, timelines, attachments, and user identities. The security question is not whether a page mentions OpenProject. It is whether the instance is owned, whether project data is meant to be public, and whether the administrative layer is separated from the collaboration layer.

What ZoomEye returned

On 2026-11-03T04:15:32Z, with page=1, pagesize=1, and sub_type=all, ZoomEye returned 12,444 total matches for title="OpenProject". At 2026-11-03T04:15:33Z, the corresponding app="OpenProject" query returned 11,684. The two counts are close enough to support a consistent discovery signal, but they still do not prove ownership, version, or public data access.

The app result is a useful primary fingerprint because it is specific to the application and close to the title population. The title result is useful for finding branded or partially fingerprinted deployments. Record both observations with their timestamps instead of choosing a single global count.

Understand the deployment surface

OpenProject's official configuration guidance covers TLS termination, reverse proxy headers, authentication providers, and external SSL. A deployment behind a proxy must tell the application that the original request used HTTPS. Otherwise generated links and secure-cookie behavior can be wrong even though the public URL looks correct.

Authentication can be local or delegated to an identity provider. Review whether local login remains enabled after SSO, how administrators are provisioned, and what happens when an account is removed from the directory. Two-factor authentication can be available, but availability is not enforcement. Check the policy for administrator and project-owner accounts.

Map the project and administrative roles. A project member may read work packages, attachments, and meeting notes. A project owner may change membership or visibility. An instance administrator can reach global settings, integrations, and user data. These roles should not share one broad group.

Review public sharing and integrations

Look for public projects, anonymous access, shared links, and API tokens. A project that is private in the web interface may still have an automation token or an external integration with broader access. Review the token owner, scope, expiry, and last use.

Inspect outbound connectors and incoming webhooks. A repository integration can reveal issue titles to another system. A webhook endpoint can accept data that the application later displays. Validate the receiver's authentication, replay protection, and size limits.

Check file attachments separately from page text. A public project may show metadata while attachments remain protected, or the reverse. Review the storage backend, upload limit, malware scanning policy, and access-control behavior for direct file URLs.

Use the counts as an inventory filter

Join the ZoomEye matches to organization-owned domains and certificate records. For each host, confirm the deployment from an authenticated administrative source. Record the version, authentication mode, public-project policy, and owner. Do not use a count as evidence that a host is vulnerable.

Use a change in app or title count as a discovery trigger. A new match under an owned domain may indicate a new project server or a proxy change. A disappearing match may indicate a rebrand, a new WAF, or a service retirement. Correlate with change records before escalating.

OpenProject is designed to make project information easy to share. That makes the ownership context essential. ZoomEye can show that many pages identify themselves as OpenProject, and the app query gives a tighter starting set. The organization still has to decide which projects are public, which identities may administer them, and which integrations can move their data.

References

• OpenProject, Configuring SSL
• OpenProject, Authentication
• OpenProject, Installation with Docker Compose