Solidtime is a self-hosted time-tracking application. A public time-tracking instance can hold client names, project descriptions, activity records, and the API tokens that let integrations read or change those records. That makes a small ZoomEye result worth treating as a precise inventory task rather than a large exposure claim.

Observation

At 08:42 on November 4, 2026 (UTC+8), a count-only ZoomEye SDK query with sub_type=all, page 1, and pagesize 1 returned zero application matches for app="Solidtime" and 49 title matches for title="Solidtime". The title result is the usable lead. It may include documentation pages, public demos, or instances whose page title differs from the project name. The result does not show which matches are production systems or which are reachable beyond a login page.

Identity surface

The review should begin with the deployment configuration. Solidtime's self-hosting documentation describes registration modes including open registration, invite-only, and disabled registration, plus a super admin panel and CLI user creation. The access API documentation says users create API tokens in their settings. Those three areas form a useful ownership checklist: who can create an account, who can create a token, and who can inspect or revoke it?

An instance with open registration is not automatically exposed, but the registration policy changes the identity population. An invite-only instance still needs a process for removing former staff and revoked client integrations. A super admin account should be tied to a controlled identity provider or a tightly scoped local account, not a shared mailbox.

API tokens deserve their own inventory. Record the token owner, creation time, last use if available, integration purpose, and whether the token can write time records. An unowned token can outlive the tool that created it. The application data should also be backed up in a way that does not make tokens or customer records broadly readable.

Controls and limits

Useful validation steps include:

  • Review the effective registration mode and super admin access list.

  • Confirm that login and API traffic are protected by HTTPS.

  • Inventory user-generated API tokens and their scopes.

  • Test whether a signed-out or revoked account can still use an old token.

  • Check whether logs expose request bodies or authorization headers.

ZoomEye can help the organization find candidate hosts and monitor changes in the visible title population. It cannot decide whether a candidate belongs to the organization, whether the registration mode is safe, or whether a token is still valid. The 49 title matches are a bounded starting set for ownership checks, not a vulnerability count.

The practical output should be a short asset ledger: host owner, environment, registration mode, admin identity, token owner, backup owner, and review date. That makes the next query comparable and keeps the article's conclusion tied to observable control decisions.

References

  • Solidtime access API documentation: https://docs.solidtime.io/user-guide/access-api

  • Solidtime self-hosting configuration: https://docs.solidtime.io/self-hosting/configuration

  • ZoomEye title query: https://www.zoomeye.ai/searchResult?q=dGl0bGU9IlNvbGlkdGltZSI%3D