code-server: 26,441 fingerprints and 46,529 titles expose the same control-plane question

code-server puts a full development environment behind a browser. That includes a file tree, terminal, extensions, proxy routes, and whatever credentials the workspace can reach. The login page is only the outer edge of a control plane that can edit code and run commands.

On 2026-11-06, ZoomEye count-only queries with sub_type=all, page 1, and pagesize 1 returned 26,441 assets for app="code-server" and 46,529 for title="code-server". The application field is the more product-specific queue. The title field is larger and may include documentation, marketplace pages, or other deployments that mention the name. Neither result proves that a workspace is unauthenticated.

code-server documentation says password authentication is enabled by default and the password is stored in ~/.config/code-server/config.yaml. It also documents a reverse proxy pattern where password authentication is disabled behind the proxy. That pattern is safe only when the proxy authenticates every request, the upstream port is not reachable directly, and the proxy strips client-supplied identity headers. Setting --auth none without a compensating gateway turns the workspace into an open terminal.

The extension and proxy surface needs equal attention. The application can proxy requests to workspace processes. Verify which ports and hosts are allowed, and whether the proxy can reach link-local or internal metadata services. Disable unused proxy behavior where possible. Treat an installed extension as code with the workspace user's access.

Inventory the identity and filesystem

Review the configured auth mode, password hash or provider, bind address, and TLS termination. Confirm that the workspace runs as an unprivileged user. Check the home directory, repository checkouts, SSH keys, cloud credentials, and mounted secrets. A code server that can read a deployment token is a credential exposure even if its login page is strong.

Use short-lived access through a gateway where available. Require MFA at the identity provider, limit source networks, and log session creation and termination. Protect the configuration file because it contains the password or hash. Rotate the password after suspected exposure and terminate active sessions by rotating the underlying secret or restarting the service.

Test direct access to the code-server port from an untrusted network, proxy access with a malformed identity header, and the failure mode when the proxy is unavailable. Confirm that a workspace cannot reach the cloud metadata endpoint or other tenants' volumes. Record the repository and secret mounts for each workspace.

The reproducible application query is available in the ZoomEye results. Use the product query to find candidate workspaces, then verify the authentication and execution boundary from an authorized system. The finding is not the count. The finding is an unauthenticated or over-privileged development plane.

References

• code-server: FAQ and authentication
• code-server: Securely access and expose the service
• code-server: Install