HomeBox stores an inventory of physical items, labels, locations, attachments, and the people who can access them. The web interface is useful for household management, but the API is the same information surface in a different form. A search result that contains the product name does not establish that item data is reachable.
HomeBox supports users, login sessions, password reset tokens, and API keys. Those are different credential lifetimes. A browser session may expire quickly while an API key remains valid for an integration. A password reset token has a different risk again because it can change the account state.
Measured observations
On 2026-11-01, app="HomeBox" returned 0 matches in the selected ZoomEye scope. The title query title="HomeBox" returned 7328. Both used page 1, page size 1, and sub_type=all.
The zero app result does not mean no HomeBox deployments exist. It means the selected application fingerprint did not return a match. The title query is broad and can include documentation, project pages, and unrelated sites. It should be used to find candidates, not to estimate a confirmed exposed population.
Inspect the application boundary
For a controlled deployment, record the public hostname, listener, TLS terminator, authentication method, registration setting, and API routes. Check whether the instance is intended for one household or multiple users. Review who can invite users, reset passwords, create API keys, and export data.
Test an unauthenticated request to the item list and to a static page. A login redirect for the browser route does not prove that every /api route requires a session. Use a test user and synthetic items for any authenticated check.
Inspect API keys for purpose and age. Keys that were created for a retired dashboard or barcode printer should be revoked. Do not expose a key in a QR code image, URL, or shared note. If the application supports static API keys in addition to session tokens, keep the two inventories separate.
Review attachments and exports
Inventory item attachments, photo storage, and export features. A public web route can be protected while direct object storage URLs remain public. Check the storage configuration and the hostnames used for uploaded files.
Export files deserve their own retention policy. A complete inventory export may include personal information, purchase records, or location descriptions. Restrict download links and remove old exports from shared directories.
Make the title count actionable
Use the title result to identify candidate deployments and collect owner evidence. Confirm the product, authentication state, and API boundary through an approved test. Then decide whether the instance should be on the public internet at all.
The count is a discovery observation. The HomeBox owner should supply the deployment and credential record, and the test should show both a rejected unauthenticated item request and a successful authorized request with synthetic data.