HomeBox title matches are an inventory lead, not proof of exposed inventory
HomeBox title matches are an inventory lead, not proof of exposed inventory
HomeBox stores an inventory of physical items, labels, locations, attachments, and the people who can access them. The web interface is useful for household management, but the API is the same information surface in a different form. A search result that contains the product name does not establish that item data is reachable.
HomeBox supports users, login sessions, password reset tokens, and API keys. Those are different credential lifetimes. A browser session may expire quickly while an API key remains valid for an integration. A password reset token has a different risk again because it can change the account state.
Measured observations
On 2026-11-01, app="HomeBox" returned 0 matches in the selected ZoomEye scope. The title query title="HomeBox" returned 7328. Both used page 1, page size 1, and sub_type=all.
The zero app result does not mean no HomeBox deployments exist. It means the selected application fingerprint did not return a match. The title query is broad and can include documentation, project pages, and unrelated sites. It should be used to find candidates, not to estimate a confirmed exposed population.
Inspect the application boundary
For a controlled deployment, record the public hostname, listener, TLS terminator, authentication method, registration setting, and API routes. Check whether the instance is intended for one household or multiple users. Review who can invite users, reset passwords, create API keys, and export data.
Test an unauthenticated request to the item list and to a static page. A login redirect for the browser route does not prove that every /api route requires a session. Use a test user and synthetic items for any authenticated check.
Inspect API keys for purpose and age. Keys that were created for a retired dashboard or barcode printer should be revoked. Do not expose a key in a QR code image, URL, or shared note. If the application supports static API keys in addition to session tokens, keep the two inventories separate.
Review attachments and exports
Inventory item attachments, photo storage, and export features. A public web route can be protected while direct object storage URLs remain public. Check the storage configuration and the hostnames used for uploaded files.
Export files deserve their own retention policy. A complete inventory export may include personal information, purchase records, or location descriptions. Restrict download links and remove old exports from shared directories.
Make the title count actionable
Use the title result to identify candidate deployments and collect owner evidence. Confirm the product, authentication state, and API boundary through an approved test. Then decide whether the instance should be on the public internet at all.
The count is a discovery observation. The HomeBox owner should supply the deployment and credential record, and the test should show both a rejected unauthenticated item request and a successful authorized request with synthetic data.
References
- HomeBox project repository
- HomeBox documentation
- ZoomEye app observation
- ZoomEye title observation
Where did I put that?
Here's something I'd like to share that will surely be a good use for everyone.
I'm always looking for things around the house. Chargers, keys, power banks, random cables... I'll put something somewhere and completely forget about it a week later.
But then I saw something on github, a small sideproject called Homebox. It is an inventory and organization system built for the Home Use! With a focus on simplicity and ease of use, homebox is the perfect solution for your home inventory, organization, and management needs.
You take a picture of an item, save its name and where you stored it, then search for it whenever you need it.
For example, instead of opening every drawer looking for your spare charger, just search for "charger" and it'll tell you where you left it.
Pretty simple, but I feel like this could save people a surprising amount of time. Especially those of us who apparently have terrible object permanence 😭
It's on github if you guys want to check
github.com/hay-kot/homebox/releases
2 points
Mentions
HomeBox title matches are an inventory lead, not proof of exposed inventory HomeBox title matches are an inventory lead, not proof of exposed inventory HomeBox stores an inventory of physical items, labels, locations, attachments, and the people who can access them. The web interface is useful for household management, but the API is the same information surface in a different form. A search result that contains the product name does not establish that item data is reachable. HomeBox supports users, login sessions, password reset tokens, and API keys. Those are different credential lifetimes. A browser session may expire quickly while an API key remains valid for an integration. A password reset token has a different risk again because it can change the account state. Measured observations On 2026-11-01, app="HomeBox" returned 0 matches in the selected ZoomEye scope. The title query title="HomeBox" returned 7328. Both used page 1, page size 1, and sub_type=all. The zero app result does not mean no HomeBox deployments exist. It means the selected application fingerprint did not return a match. The title query is broad and can include documentation, project pages, and unrelated sites. It should be used to find candidates, not to estimate a confirmed exposed population. Inspect the application boundary For a controlled deployment, record the public hostname, listener, TLS terminator, authentication method, registration setting, and API routes. Check whether the instance is intended for one household or multiple users. Review who can invite users, reset passwords, create API keys, and export data. Test an unauthenticated request to the item list and to a static page. A login redirect for the browser route does not prove that every /api route requires a session. Use a test user and synthetic items for any authenticated check. Inspect API keys for purpose and age. Keys that were created for a retired dashboard or barcode printer should be revoked. Do not expose a key in a QR code image, URL, or shared note. If the application supports static API keys in addition to session tokens, keep the two inventories separate. Review attachments and exports Inventory item attachments, photo storage, and export features. A public web route can be protected while direct object storage URLs remain public. Check the storage configuration and the hostnames used for uploaded files. Export files deserve their own retention policy. A complete inventory export may include personal information, purchase records, or location descriptions. Restrict download links and remove old exports from shared directories. Make the title count actionable Use the title result to identify candidate deployments and collect owner evidence. Confirm the product, authentication state, and API boundary through an approved test. Then decide whether the instance should be on the public internet at all. The count is a discovery observation. The HomeBox owner should supply the deployment and credential record, and the test should show both a rejected unauthenticated item request and a successful authorized request with synthetic data. References - HomeBox project repository - HomeBox documentation - ZoomEye app observation - ZoomEye title observation
Where did I put that? Here's something I'd like to share that will surely be a good use for everyone. I'm always looking for things around the house. Chargers, keys, power banks, random cables... I'll put something somewhere and completely forget about it a week later. But then I saw something on github, a small sideproject called Homebox. It is an inventory and organization system built for the Home Use! With a focus on simplicity and ease of use, homebox is the perfect solution for your home inventory, organization, and management needs. You take a picture of an item, save its name and where you stored it, then search for it whenever you need it. For example, instead of opening every drawer looking for your spare charger, just search for "charger" and it'll tell you where you left it. Pretty simple, but I feel like this could save people a surprising amount of time. Especially those of us who apparently have terrible object permanence 😭 It's on github if you guys want to check github.com/hay-kot/homebox/releases