Apache ShenYu separates its gateway bootstrap service from the Admin service that manages plugins, selectors, rules, metadata, and authentication data. Namespaces can isolate gateway configuration for different business lines. The Admin service uses Apache Shiro for authentication, and deployment configuration includes JWT and synchronization secrets.
That architecture creates two review questions. Who can reach the Admin service, and which configuration does an authenticated user control?
What the measurement shows
On 2026-11-10T17:47:28.045591+00:00, a ZoomEye SDK query used sub_type=all, page 1, and page size 1:
title="ShenYu"
The query returned 564 total matches. This is a title observation. It can identify a login page or documentation page and cannot prove that the Admin service is externally reachable. Verify the product and the route before using the result in an exposure report.
Separate Admin and Bootstrap
The ShenYu Admin service stores and manages gateway configuration. The Bootstrap service applies configuration and forwards traffic. Their network roles are different. Put the Admin service on a management path that is not generally reachable from the public data plane.
Confirm the Admin login endpoint, JWT secret source, synchronization token, and database connection. A default or shared JWT secret can let a token created outside the intended deployment authenticate as an admin. The synchronization token protects communication between services and should have the same custody controls as other service credentials.
Do not use discovery traffic to change selectors or plugins. A control-plane change can redirect production traffic.
Review namespaces and roles
ShenYu namespaces provide data isolation for gateway configuration. The namespace ID is part of the downstream client configuration. A namespace that mixes unrelated applications weakens the organizational boundary even when the product supports isolation.
Inventory each namespace, its gateway clients, selectors, rules, and owners. Review normal users and the super administrator. Role management should map each user or group to the resources they manage, not grant all menus because it simplifies administration.
Look for routes that reference a deleted downstream service, rules that disable an authentication plugin, or selectors that send traffic to an unexpected upstream. These are configuration findings that require source and change-record comparison.
Trace synchronization and storage
The Admin service persists configuration and pushes changes to gateway nodes. Record the synchronization mechanism, its authentication, and the network path. A WebSocket or long-polling channel that accepts unauthenticated updates can become a direct control-plane path.
Review the Admin database credentials and backups. A backup that contains admin users and gateway configuration should be protected like the live control plane. Restrict who can restore it and test that restored credentials are rotated before the environment returns to service.
Use ZoomEye for targeted discovery
Use the title query to find candidate ShenYu hosts. Verify the login page and product identity through approved access. Compare the result with the gateway inventory, including environment and namespace ownership.
The count is a candidate measure, not a vulnerability count. An externally reachable login page may be intentional. The review should identify whether the route leads to the Admin service and whether that service has the expected network and authentication controls.
Keep a control-plane ledger
For each confirmed ShenYu deployment, record the Admin URL, Bootstrap group, JWT secret owner, sync token owner, database, namespaces, administrators, and last configuration change. Re-run the review after secret rotation, namespace changes, and gateway onboarding.
ShenYu's separation of Admin and Bootstrap is useful when the network and identity boundaries match the architecture. Namespace design and secret custody decide whether that separation remains effective.