Meilisearch provides fast search over application indexes. A visible search interface may be expected, while the administrative API that creates indexes, changes settings, and manages keys should not be public. Internet measurement can find product instances, but the product fingerprint says nothing about which API keys are in use or what those keys can reach.
A standalone ZoomEye SDK query using sub_type=all, page 1, and page size 1 returned 4,885 matches for app="Meilisearch" and 4,883 for title="Meilisearch" on 30 October 2026 at 00:40 UTC. The near-equal counts make the application fingerprint more useful here than in products where a generic title produces many unrelated pages. They still describe matching observations, not confirmed vulnerable instances.
Separate search from administration
Meilisearch's production mode requires authentication when the master key is set. The master key can create or manage API keys, while ordinary API keys should be used for searches and controlled operations. The product documentation strongly discourages using the master key for normal API calls. An exposed search route can be valid, but a master key in a browser, mobile application, or static configuration gives every user a path to broader control.
Review key actions, indexes, and tenant restrictions. Use the smallest index and action set required by each client. Tenant tokens can restrict search results to a tenant or user scope, but they depend on a correctly scoped parent key and a rule that matches the application's data model. A token that is short lived still needs a narrow action and index scope.
Treat the index as a data store
Search indexes often contain text copied from databases, support tickets, product catalogs, or user profiles. A search API may return highlights and field values that the primary application would not show. Review which attributes are searchable, displayed, and filterable. Test with a low-privilege key and confirm that protected fields and cross-tenant documents are absent from results and suggestions.
Review indexing jobs as a data path. A compromised indexing credential may be able to replace documents, delete an index, or copy data into a new index. Keep indexing credentials separate from search credentials. Log key creation, deletion, index changes, and unusual document volumes.
Verify the exposure on owned hosts
Use the app match as a starting point for the organization's own assets. Confirm the Meilisearch version and build through approved management channels. Request a harmless endpoint with no key, a search-only key, and an administrative key. The expected status codes and response bodies should match the threat model. Do not use a discovered third-party instance as a test target.
A title match can be a deliberate public demo or an internal application with a broad search page. The useful inventory record includes which index scope, key action, tenant rule, and network boundary protect the service behind that page.