FastGPT's 3,306 Application Fingerprints Point to a Team and Data Authority Review

FastGPT is a self-hostable knowledge-base and application platform. A ZoomEye count-only probe on November 15, 2026 returned 3,306 app="FastGPT" matches, 310 title="FastGPT" matches, and 11,198 http.body="FastGPT" matches. The scope was sub_type=all, page 1, and page size 1.

The application count is the strongest of the three product-specific observations, but it is still not a count of vulnerable or publicly usable deployments. A fingerprint can identify an application surface without proving that a user can log in, that a team is active, or that a dataset contains sensitive material. The count is useful for prioritization and follow-up.

The API boundary is layered

FastGPT's OpenAPI documentation separates application access from team and resource permissions. An application key can invoke a published app, while the application itself may rely on team membership, a dataset, and configured tools. The backend that receives a request still needs to authenticate the caller and decide whether that caller may use the app.

Do not treat an app key as a workspace administrator credential. Inventory which user or team owns the key, which application ID it targets, and whether the key can use development or system endpoints. The official integration guidance distinguishes these API surfaces and says to check the authentication method for each endpoint.

If an OpenAI-compatible endpoint is enabled for convenience, verify its app ID resolution and key format. A compatibility layer that accepts the wrong key shape can attach a request to an unintended app. Test with a key from a different team and confirm that the request is rejected.

Datasets and tools carry authority

A knowledge-base application is valuable because it connects model calls to retrieved data and tools. Review dataset membership, document ingestion, vector-store access, model-provider keys, and HTTP tool credentials. A public chat interface that uses a private dataset can expose content without exposing the dataset administration page.

Limit server-side HTTP tools to approved destinations. A tool that can call arbitrary URLs creates an egress boundary even when the chat user cannot reach the target. Keep model provider keys in the server's secret store and rotate them if an application or workspace is transferred.

Team membership is not just a UI feature. It decides who can see applications, datasets, and usage. Remove inactive members and service accounts, and confirm that removing a member invalidates sessions and API keys that were tied to that identity.

Review the discovered instances

Start with application fingerprints that return a FastGPT interface. Verify the deployment type and whether it is public, internal, or a demo. For each confirmed instance, record the team model, public app inventory, signup policy, API keys, and dataset owners.

The 310 title matches and 11,198 body matches capture different evidence. A title match may be a branded login page. A body match may be a help article or an integration page. Keep the exact dorks and observation time with the finding, and do not sum the categories as if they were unique hosts.

Monitor for changes in the application fingerprint around known deployment ranges. A new instance may be a test environment with copied data. A disappearing fingerprint may mean a host was removed or that the response changed, not necessarily that the application is gone.

Measure the control plane

The practical inventory fields are owner, deployment URL, authentication method, team count, public app count, dataset count, model-provider account, tool destinations, and API-key owners. Add a review date and the last verified configuration version.

FastGPT concentrates several sensitive relationships in one interface. The ZoomEye fingerprint is a way to find candidate control planes. The security decision is whether the team, dataset, tool, and key boundaries match the data the application can reach.

References

• FastGPT OpenAPI introduction
• FastGPT app API access
• ZoomEye count evidence for this article