GoToSocial combines ActivityPub federation with a Mastodon-compatible client API and an administrative settings interface. On 2026-11-04, ZoomEye returned 132 matches for app="GoToSocial" and 339 for title="GoToSocial" with page 1, page size 1 and sub_type=all. The application field gives a stronger product lead than the title field, but it still describes matching assets rather than confirmed vulnerable instances.
The API has a version-dependent scope boundary
GoToSocial's authentication documentation says scoped authorization tokens were not supported before version 0.19.0. In older releases, a token could perform all actions available to the account, including administrative actions if the account had those permissions. That makes token issuance, storage and revocation a higher-priority review item for older deployments.
For current versions, check the requested scopes and the account role behind the token. A client token should not be able to manage federation settings unless the workflow explicitly requires it. Administrative settings use the admin API, so the admin interface and the public client API should have separate access controls even when they share a host.
Federation is a policy decision
GoToSocial supports blocklist and allowlist federation modes. The selected mode changes which remote domains can interact with the instance. Inventory the effective configuration and the import/export controls for the domain list. A public API result does not tell an observer which mode is active.
For owned instances, review the admin panel route, OAuth callbacks, token scopes and federation filters. Test that an ordinary account cannot call an admin endpoint. Test that an old client token is revoked after an account or role change.
A practical triage sequence
- 1.
Confirm the host belongs to the organization.
- 2.
Record the version if it is publicly exposed.
- 3.
Check whether the public API and admin settings share an origin.
- 4.
Review token scopes and account roles.
- 5.
Verify federation mode and blocklist or allowlist ownership.
Do not enumerate users or attempt administrative calls on third-party instances. The measurement is enough to decide whether a domain should be investigated.
What the comparison shows
The application and title counts are in the same order of magnitude, which makes the product lead more useful than a title-only population. They still do not prove that every application match is a live GoToSocial instance or that every title match is unrelated. Fingerprints can be inherited from a base image, reverse proxy or copied page.
ZoomEye is most useful when the count is paired with a documented control. Here that control is token scope and federation policy. The external count narrows the review queue. The instance's authentication behavior determines the risk.
References
[1] GoToSocial API authentication