HedgeDoc is a collaborative Markdown editor that teams can self-host. Its data model encourages sharing notes, publishing documents, and inviting collaborators. Internet exposure can be intentional, such as a public documentation site. It can also be an accident around a private note service. The control question is which notes, uploads, metrics, and account actions are reachable without the right identity.
A standalone ZoomEye SDK query using sub_type=all, page 1, and page size 1 returned 0 observations for app="HedgeDoc" and 3,604 for title="HedgeDoc" on 30 October 2026 at 00:40 UTC. The title count is a matched HTML-title observation, not a count of unauthenticated notes. A deployment can show a HedgeDoc title while requiring login for every note, or it can expose guest access intentionally.
Separate public notes from service endpoints
HedgeDoc's production guidance recommends a reverse proxy for TLS and discusses limiting operational endpoints. The /status and /metrics paths can reveal service information. Keep them on a private monitoring path or disable the more verbose endpoints when the deployment does not need them. A public status endpoint is not automatically a data breach, but it should be a deliberate monitoring decision.
Review note visibility separately from login. A private instance can use a public instance-level sign-in page while restricting individual notes. Check whether guest editing, free URLs, uploads, and exports are enabled. Map each feature to a role and a retention rule. A note that can be edited by anyone with a URL is a bearer-link control, so its distribution and logging need the same treatment as a shared credential.
Control the proxy and session path
The reverse proxy should overwrite forwarded protocol and host headers and pass HTTPS state correctly. HedgeDoc's documentation warns that HTTPS deployments need the protocol settings to match. A mismatch can produce broken login callbacks, insecure cookies, or redirects to the wrong scheme. Test the full login and callback path through the public hostname.
Set session lifetime and cookie flags from the actual deployment. Review identity provider group mappings if external authentication is used. Remove accounts that no longer need access, and check whether an account can create a public link after its role changes. Logging should record note creation, access-control changes, and administrative actions without recording note contents.
Inventory content and backups
Notes, attachments, the database, and reverse-proxy logs form separate data stores. A public note does not justify exposing the database or attachment directory. Confirm that backups are encrypted, access controlled, and subject to the same deletion expectations as the live notes.
For external discovery, combine the title observation with host ownership and a second fingerprint. Do not attempt to read or modify unrelated notes. The operational decision is to know whether each HedgeDoc deployment is meant for public documentation, authenticated collaboration, or internal use, and then verify that its sharing defaults and monitoring endpoints match that purpose.