Coolify discovery must include team roles, API tokens, and host control
Coolify is a self-hosted deployment platform that manages applications, databases, services, and servers from a dashboard. Its control plane combines team access, API tokens, Git integrations, deployment credentials, encrypted configuration, and server-level SSH authority. A product match is therefore a prompt to review administrative reach, not a finding by itself.
A ZoomEye count-only measurement on October 31, 2026 at 06:44 Beijing time used page 1, page size 1, and sub_type=all. app="Coolify" returned 3 matches and title="Coolify" returned 70,486. These are visible ZoomEye fingerprint counts. They do not show that a matching dashboard is unauthenticated, that a team role is excessive, or that a deployment is vulnerable.
Interpret the gap without inflating it
The app count is small and the title count is large. Title matches can include documentation, comparisons, help pages, and public websites that mention Coolify. The app result is narrower but still depends on the deployed response and proxy behavior. A small app count does not mean the three matches are the only installations, and a large title count does not mean 70,486 exposed dashboards.
Use the title list to find candidates for an ownership match. Confirm the hostname through DNS, certificate, cloud, and asset records. For an authorized deployment, verify the product and version from the application and compare the public route with the internal inventory. Do not use the login page to test credentials on an unowned system.
Review the security boundary
Coolify's security documentation states that the platform supplies dashboard authentication, optional two-factor authentication, OAuth sign-in, team-based controls, authenticated API access with selected permissions, expiration, and optional source-IP restrictions. It also states that self-hosted operators remain responsible for SSH, Docker, firewall rules, application code, public endpoints, backups, and secret rotation.
That split defines the review. Check team ownership, role assignments, invitation policy, SSO mapping, and administrator accounts. Enumerate API tokens by owner, scope, expiry, and source restriction. Rotate tokens that lack a current use, and remove team members who no longer deploy or administer services.
Review the application's APP_KEY protection and the host's .env access. The control plane can decrypt supported credentials, so filesystem and backup access are part of the security boundary. Restrict server SSH keys by role and verify that deployment credentials cannot be reused from an unrelated system.
Validate the host and network
The dashboard is only one route. Check the public IP, documented management ports, Docker socket, SSH, and any direct application route. A firewall or identity-aware proxy should close paths that bypass the dashboard. Confirm TLS certificates and redirects after proxy changes. Review whether the dashboard host is intentionally public or belongs on a management network.
Test a team member without administrative rights, a disabled user, an expired token, and a token restricted to approved source addresses. Verify that offboarding removes team membership, deployment secrets, and personal access. Check backups and restore procedures because a control-plane restore can reintroduce old users, tokens, or deployment settings.
Build an evidence record
A useful Coolify inventory includes the dashboard hostname, server owner, environment, version, team model, identity provider, API-token policy, deployment source, encrypted-secret storage, backup location, and last restore test. Add the exact external query, count, time, and scope that led to the review.
ZoomEye can expose a forgotten public management route. It cannot show whether the team roles or host controls are sound. The owned configuration and negative tests provide that evidence.
Conclusion
Coolify's title population is broad and its app fingerprint is narrow. The security decision depends on dashboard exposure, team roles, API-token scope, host SSH authority, encrypted configuration, and restore behavior. Those controls should be checked together, with the external count treated only as a discovery lead.
Top comments (0)