DSpace repositories hold publications, datasets, theses and archival objects. The public catalog is only one route to that material. OAI-PMH can expose metadata for harvesting, while the REST API and bitstream endpoints deliver files under access policies. A title search can find candidate repositories, but it cannot tell a reviewer whether the metadata and the underlying files obey the same boundary.
The verified observations were 1 application match for app="DSpace" and 9,557 title matches for title="DSpace", with sub_type=all, page 1 and page size 1. The title query ran at 23:44:35 UTC and the application query at 23:44:33 UTC. The large gap between the two counts is a warning about fingerprint coverage. It is not a count of vulnerable repositories.
OAI-PMH is a useful first check because it is designed for metadata exchange. DSpace documentation has historically noted that OAI may expose item metadata even when access policies restrict the bitstreams. Current deployments and configurations can differ, so test the installed version and the actual OAI endpoint. Review the set structure, record granularity, deleted-record handling and whether internal notes or sensitive metadata fields are being exported.
The next check is the bitstream path. A public metadata record does not necessarily make a file public. Request a restricted file through the browser, through the REST API and through any legacy handle or download URL that remains enabled. Confirm the authorization decision at every path. DSpace's REST authentication should be tested with anonymous, authenticated and administrator sessions. A valid login is not the same as permission to download the requested bitstream.
Repository administrators should inventory persistent identifiers and landing pages. A handle or DOI can redirect to an old host, a migrated repository or a page that still exposes a file. Review redirects and legacy URLs after a platform migration. A new repository can inherit metadata while an old file endpoint remains reachable. The public catalog may look correct even when the historical URL does not.
Search indexing adds another exposure layer. Metadata can appear in ZoomEye, general search engines, OAI harvesters and institutional catalogs. If a collection was intended to be private, removing the item from the primary browse page is insufficient. Remove or restrict the OAI record, invalidate cached pages, and test the bitstream and metadata URLs after the change. Document the delay expected from each index.
The 9,557 title matches provide a broad candidate set, but the title can refer to project documentation, a demo, a service page or a customized repository. Confirm the application, then test one metadata path and one file path with the same access role. Record the expected result before testing. That small matrix is more useful than treating the product count as proof of a security condition.
DSpace is built to make scholarship discoverable. The control objective is to make the publication boundary explicit across metadata, files, APIs and historical URLs. ZoomEye helps locate the repositories. The repository owner has to prove that an OAI record and a bitstream tell the same access story.