ZoomEye finds 274 exposed Quivr instances holding docs and keys

A ZoomEye scan on 2026-10-23 returned 274 hosts exposing the self-hosted RAG platform Quivr (266 matched by title). Each deployment holds source documents, embedding vectors and a model provider key, so a single permission mistake can expose both a document corpus and a billing relationship.

• ZoomEye: 274 hosts for app="Quivr", 266 for title="Quivr"
• Each instance stores documents, embeddings and a provider key
• Shared collections let recipients extract arbitrary corpus content
• Ingested documents enter prompts and can carry injections