ZoomEye finds 4,692 exposed Drone CI servers

A ZoomEye scan on 23 October 2026 returned 4,692 matches for app="Drone", versus 26,577 for title="Drone" and 8,440 for title="Drone" on port 80. CI servers hold source control tokens, registry credentials and pipeline secrets, making them high-value attack targets.

• 4,692 app="Drone" matches vs 26,577 title="Drone" matches
• 8,440 title matches on port 80 are a lower bound on coincidence
• Drone stores SCM tokens, registry keys and pipeline secrets
• Open sign-up lets users run arbitrary code in the runner