Analytics platforms sit between public websites and private behavioral data. Rybbit exposes a Stats API and supports site-level analytics that can be made public. That pairing creates two useful inventory questions: which sites are publicly readable and which API keys can reach private data or management actions?
Small public footprint
On 2026-11-07 UTC, page-one count-only ZoomEye queries with sub_type=all returned zero for app="Rybbit" and 10 for title="Rybbit". The title total is small enough that each match should be reviewed rather than aggregated. A handful of pages can include documentation, demos and services that do not expose analytics data.
Rybbit's API documentation says read endpoints for a site with Public Analytics enabled answer without credentials. Those responses can disclose traffic patterns, referrers and behavioral aggregates by design. The review should identify which sites have that setting, whether the information is intended for public use and who can change the setting.
Private API calls use bearer credentials. Record the owning user or organization, the site scope and the token's purpose. Do not place a management key in browser code or in a public dashboard that only needs a limited public read.
Separate access from product state
A title match does not reveal whether Public Analytics is on, whether the host is a test instance or whether private API access is enabled. Owned deployments should verify the setting through the application and compare it with the site's audience. A customer analytics page can be useful to investors while still exposing operational patterns to competitors.
Review API keys after staff changes and after a site moves between teams. Revoke keys used by retired integrations and test that old keys fail. Monitor management endpoints for changes to public settings and for access from unexpected networks.
An inventory workflow
Keep the ZoomEye observation as a dated candidate set. Enrich each candidate through DNS ownership and the user's own asset inventory. For owned sites, record owner, public-visibility setting, API-key scope and last review. For a service with only 10 title matches, manual review is practical and more reliable than assuming that every match represents the same deployment.
Rybbit's product value is clear when the result is a controlled decision about public data. A count alone cannot distinguish a deliberate transparency page from an accidental data surface.