A continuous integration server is a machine that runs code from your repository with credentials you gave it. Drone is one of the smaller players in that category, and the gap between its two measurement methods is the largest in this batch after Coolify.

The measurements

On 23 October 2026, ZoomEye returned 4,692 matches for app="Drone", 26,577 matches for title="Drone", and 8,440 matches for title="Drone" && port="80".
A title count more than five times the fingerprint count is a strong signal that the string is doing work the product did not ask it to do. "Drone" appears in page titles for hardware, for photography, for music, and for a great many other things. The application fingerprint query is the only one of the three that is plausibly describing the CI product.
The port-constrained query is less useful here than in other articles in this batch, because port 80 is the most common port on the internet. Restricting a generic word to a generic port narrows the population without making it specific. Treat 8,440 as a lower bound on coincidence rather than an estimate of CI servers.

Why the fingerprint number is the one to use

4,692 is a defensible magnitude for a self-hosted CI tool with a long history and a large open-source following. The figure is small enough to be a real product population and large enough that automated scanning against it is economically rational for an attacker.
What a Drone server holds is the reason that matters. A CI server is configured with a source control token that can read repositories, a registry credential that can push images, and usually a deployment credential for one or more target environments. It also holds the environment variables of every pipeline it builds, which in most organisations includes at least one production secret that someone put in a pipeline because it was the fastest path.
That combination makes a CI server a higher-value target than a web application of the same size. It is trusted by systems that are not themselves exposed, and it holds the keys to them.

The repositories as an attack path

A public CI server with an open registration policy is worse than an exposed dashboard. Drone's model links a server to a source control provider, and a user who can authenticate can create a build that runs arbitrary code in the runner. If the runner shares a network with production, or if the pipeline environment contains organisation-wide secrets, that build is a compromise path that requires no vulnerability at all.
This is not a defect in Drone. It is the intended behaviour of a CI system, and every product in the category shares it. The control is who can register, which repositories can build, and what secrets a build can read.

Reading the counts with discipline

State the facts: 4,692 application fingerprint matches, 26,577 title matches, 8,440 title matches restricted to port 80, sub-type all, collected on 23 October 2026. Note explicitly that the title field is a common English word and that the title-based figure should not be used as an install count.
None of the three counts reveals a release version. Drone's release history includes security-relevant changes, and the changelog is the authoritative source for what a given version contains.

Operational checks

Confirm whether your Drone instance allows open sign-up. If it does, the set of people who can run code on your runners is larger than the set of people you have onboarded.
Review which secrets are available to a pull request build as opposed to a trusted branch build. A pipeline that exposes deployment credentials to a fork's pull request is a credential leak waiting for a contributor.
Restrict the runner network. A runner that can reach the production database because it sits on the same subnet is a design decision that a firewall rule can reverse.
Log and review the creation of new builds by users who have not built before. The signal is behavioural and it is available in the product's own audit surface.

The closing point

The gap between 26,577 and 4,692 is a reminder that a common word in a page title is not a measurement. The number that matters for this product is the smaller one, and the reason it matters is not the server's own interface but the credentials that interface was given.

References

  • Drone documentation, https://docs.drone.io/

  • Drone project repository, https://github.com/drone/drone

  • ZoomEye AI query results collected 23 October 2026 for app="Drone", title="Drone", and title="Drone" && port="80", sub-type all