A zero result from one product query can look like an all-clear. It usually means only that the selected fingerprint did not match any returned total. CryptPad provides a useful example because its title query and application query produced very different observations during the same measurement.

The measurement

On 2026-10-30, ZoomEye count-only queries were run with sub_type=all, page 1, and page size 1. app="CryptPad" returned 0. title="CryptPad" returned 2,269. Both searches succeeded. The zero is a valid count for that fingerprint, not an authentication or network error.

The app match may be absent because the product fingerprint uses a different label, the observed pages do not expose the expected signature, or the collection scope does not include the relevant asset type. The title match shows that the product name appears in page titles. It does not show which match is a public instance, a login page, a documentation page, or an unrelated title that happens to contain the phrase.

Keep the pair as separate observations and review the matching CryptPad pages before describing the result as 2,269 confirmed servers.

Encryption does not remove the service boundary

CryptPad's project documentation describes browser-side encryption and a self-hosted deployment model. Encryption reduces what the server can read from document content when the client and deployment behave as designed. It does not make account recovery, sharing links, guest access, or the administrative panel irrelevant.

The user account documentation describes access lists, password protection, expiry settings, safe links, and account two-factor authentication. Those controls define how a collaborator receives access. An access link can be intended to be public, but its scope should still be understood. A safe-link setting that requires the recipient to already have the document in CryptDrive changes the delivery path and should be tested with the intended browser flow.

Instance administrators have a different role from document collaborators. The administration documentation describes guest-access controls, registration settings, and support tools. A server that permits open registration or guest use has a legitimate design, but the owner should know that choice and monitor abuse.

Build an internal view

Start with DNS, certificate transparency, and known deployment records. Identify CryptPad hostnames that belong to the organization. For each, record the version or release channel, whether registration is open, whether guest access is enabled, and who can reach the administration panel.

Test a shared document with a disposable account. Verify view, edit, expiry, and access-list behavior. Check what happens when the password is wrong and when a link is opened after its expiry. Do not test with real customer documents.

Inspect the reverse proxy and storage paths. Even when document content is encrypted, logs, uploads, and backup metadata can reveal activity or filenames. Ensure that the administration surface is not exposed to the public internet unless there is a documented reason and a strong access control.

Make zero actionable

A zero app count should trigger a fingerprint review. Check whether another label or page title is a better candidate. Search the organization's own DNS inventory in parallel. Report the failed concept, not an inferred absence: the query found no app match in this scope at this time.

The useful outcome is a list of owned CryptPad hosts, a clear note about which sharing and guest features are enabled, and a tested separation between the document collaboration path and administration. That is more defensible than a single zero beside a product name.

References