Weaviate at 7,856 body matches: reading a vector store's public surface
Weaviate at 7,856 body matches: reading a vector store's public surface
Weaviate is a vector database used to build semantic search and retrieval over private corpora. A deployment that answers requests without authentication returns schema information that describes the corpus and often the data inside it.
What the measurement covers
ZoomEye returns 7,856 matches for the body string Weaviate and 59 matches for the page title Weaviate. The default HTTP port is 8080, which is a shared port, so a port query cannot attribute assets to this product and was not used.
Scope: the query ran against the international ZoomEye index with sub_type=all. Counts are a snapshot at collection time and the index is refreshed continuously.
Why the number matters
Weaviate exposes a REST and a GraphQL endpoint. A schema request lists the classes and their properties, which reveals the shape of the corpus: whether it holds support tickets, code, legal text or customer conversations. That is metadata about sensitive material, and it is available before any data is read.
The body count is much larger than the title count, which is the expected pattern for a service that returns JSON. JSON responses carry the product name in the payload rather than in an HTML title. That also means the body count includes API responses, not only rendered pages.
Reading the evidence
A body match on a JSON API is a weaker attribution than a title match on an interface, so the 7,856 figure should be read as an upper bound on the surrounding surface, not as a count of open databases. The 59 title matches are the narrower set.
Because 8080 is used by many products, exposure cannot be measured from this port. Reporting a port count here would misattribute assets, so the honest result is that the port query is not informative for this product.
Practical next steps
Enable authentication and an API key for the vector store, and restrict the network path so only the application tier reaches it. Review the schema to confirm that class and property names do not themselves disclose sensitive topics. Where a management interface exists, place it behind the same authentication and remove sample or test classes from production collections.
References
- Weaviate, Authentication
- Weaviate, Project repository
- ZoomEye, Cyberspace search
Mentions
@BrettDavies @weaviate_io Have created a PR here: docs#596 Thanks for the tip @BrettDavies and god luck with anc.dev :)
It replaces Webpack with Rspack, Babel and Terser with SWC, and the CSS minifier with Lightning CSS. You turn it on with future.experimental_faster: true in docusaurus.config.js. If you want to try it out, see our diff: docs#576
my gift to Austria on this glorious day! github.com/weaviate/weaviate-go-client/releases/t…
Weaviate at 7,856 body matches: reading a vector store's public surface Weaviate at 7,856 body matches: reading a vector store's public surface Weaviate is a vector database used to build semantic search and retrieval over private corpora. A deployment that answers requests without authentication returns schema information that describes the corpus and often the data inside it. What the measurement covers ZoomEye returns 7,856 matches for the body string Weaviate and 59 matches for the page title Weaviate. The default HTTP port is 8080, which is a shared port, so a port query cannot attribute assets to this product and was not used. Scope: the query ran against the international ZoomEye index with sub_type=all. Counts are a snapshot at collection time and the index is refreshed continuously. Why the number matters Weaviate exposes a REST and a GraphQL endpoint. A schema request lists the classes and their properties, which reveals the shape of the corpus: whether it holds support tickets, code, legal text or customer conversations. That is metadata about sensitive material, and it is available before any data is read. The body count is much larger than the title count, which is the expected pattern for a service that returns JSON. JSON responses carry the product name in the payload rather than in an HTML title. That also means the body count includes API responses, not only rendered pages. Reading the evidence A body match on a JSON API is a weaker attribution than a title match on an interface, so the 7,856 figure should be read as an upper bound on the surrounding surface, not as a count of open databases. The 59 title matches are the narrower set. Because 8080 is used by many products, exposure cannot be measured from this port. Reporting a port count here would misattribute assets, so the honest result is that the port query is not informative for this product. Practical next steps Enable authentication and an API key for the vector store, and restrict the network path so only the application tier reaches it. Review the schema to confirm that class and property names do not themselves disclose sensitive topics. Where a management interface exists, place it behind the same authentication and remove sample or test classes from production collections. References - Weaviate, Authentication - Weaviate, Project repository - ZoomEye, Cyberspace search