Mealie's API documentation and signup settings need an explicit public boundary
Mealie's API documentation and signup settings need an explicit public boundary Mealie is a self-hosted recipe manager with a web interface and an API. A family recipe collection can contain meal plans, shopping lists,
Mealie's API documentation and signup settings need an explicit public boundary
Mealie is a self-hosted recipe manager with a web interface and an API. A family recipe collection can contain meal plans, shopping lists, household groups, and personal account data. The deployment configuration decides how much of that surface is reachable without an account.
A count-only ZoomEye query gives a current title-match population. The selected query title="Mealie" used sub_type=all, page 1, pagesize 1, and returned 4071 matches at 2026-11-02T17:51:17.092009+00:00. The count describes matching public services, not confirmed vulnerable or compromised assets.
Configuration controls the public shape
Mealie's backend configuration lists API_DOCS as true by default, which turns on local API documentation. It also lists ALLOW_SIGNUP as false by default, with an explicit warning that a true value allows sign-up without a token. SECURITY_MAX_LOGIN_ATTEMPTS defaults to 5.
Those defaults are not a complete security policy. A public API documentation page can help users and can also disclose endpoint names, schemas, and version details. An operator who does not need the page can disable it. An operator who keeps it should know which proxy routes expose it.
OIDC adds another path. The configuration includes OIDC_REQUIRES_EMAIL_VERIFICATION, with a default of true in the documented version. It prevents an unverified email from being matched to an existing account. An operator who disables the check for a provider that omits the claim needs a compensating identity control.
Test the account and API paths
For each owned match, map the web interface, API base, and documentation route. Confirm that the public proxy enforces the same authentication policy on each. A web login redirect does not prove that /docs or an API route is protected.
Test sign-up with a new account when signup is supposed to be closed. Test a login failure count against the lockout setting. Test an API token from a non-member account and confirm that it cannot read another household's data.
Review OIDC group and admin mapping. OIDC_USER_GROUP can restrict access, while OIDC_ADMIN_GROUP grants administrative status. A group claim that the provider does not control precisely can make either setting broader than intended.
Keep the count and the control separate
The exact query was title="Mealie" with sub_type=all, page 1, pagesize 1. It counts public responses that match the title. It does not confirm the version, configuration, or account policy.
Use the count for attribution and ownership review. Record the observation time, canonical hostname, version, API documentation status, signup setting, and OIDC provider. Re-run the query on a defined schedule and compare both the classified inventory and the raw number.
Mealie is designed for household use, but the service still has identity and data boundaries. Make the public API and signup choices explicit, test every route that reaches them, and keep the account lifecycle visible to the owner.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.