Small numbers invite the wrong conclusion. A query that returns 66 matches for an application fingerprint looks like a product nobody uses, and a query that returns 17 matches for that fingerprint on a specific port looks like a rounding error. Both readings miss what the product is.

The three measurements

On 23 October 2026, ZoomEye returned 66 matches for app="PocketBase", 119 matches for title="PocketBase", and 17 matches for title="PocketBase" && port="8090".
The fingerprint and title counts are close enough to suggest a working signature and a modest public population. The port-constrained count is the interesting one: only 17 of the 66 fingerprinted hosts present the product's documented default port. PocketBase's own documentation shows the default listener on 8090.

What the product is

PocketBase is a single-binary backend. It bundles an embedded database, an authentication layer, file storage, a realtime subscription API, and an administrative dashboard in one executable. The design goal is that a developer can run one file and have a complete backend, including an admin UI, with no external dependencies.
That packaging is the reason the counts are small and the reason they should not be dismissed. A single binary is easy to drop onto a VPS for a prototype, a side project, or an internal tool. It is also easy to leave running after the prototype becomes something people depend on, because there is no package manager update, no container orchestration review, and no infrastructure team in the loop.

The administrative surface

PocketBase's dashboard is served by the same process as the application API. The dashboard is where collections, rules, and admin accounts are defined. Access rules in PocketBase are configured per collection, and the default is not always restrictive: a collection created during development frequently ends up with public read or write rules that were convenient at the time.
The consequence is that a public PocketBase instance is not simply a backend with a login form. It is a backend where the authorisation model is expressed as rules that a developer wrote, and those rules are the actual access control. A single permissive rule on a collection exposes data with no authentication step at all.
The version matters for a different reason. PocketBase has changed its API and its security model across releases, and a binary from an early release behaves differently from a current one. The counts here say nothing about which release a host runs.

Reading 17 out of 66

The port observation is a proxy for how the deployment was done. A host on 8090 is a host configured with the documented default, which usually means a developer followed the docs and did not add a reverse proxy. A host on 443 with a hostname has had at least one production conversation.
Neither configuration is safe or unsafe in itself. The distinction is useful because 17 is a number small enough that a defender can think about the whole category rather than a sample. If your organisation has a PocketBase instance, it is one of a small global population, and the reason it exists is almost certainly a specific project rather than a platform standard.

What to do about a PocketBase deployment

Enumerate the collections and their rules. That is the authorisation model, and reviewing it is more useful than checking whether the dashboard requires a password.
Check whether the dashboard is reachable from the same network as the application. Separating them is a reverse-proxy rule in most deployments, and it removes an administrative surface from the internet.
Confirm the release and read the changelog for the interval between your version and current. PocketBase's release notes document security-relevant changes, and the interval is the part that matters rather than the specific version string.
Then check backups. A single-binary deployment makes backup easy to forget, because there is no database server to snapshot. A compromised or lost instance with no backup is a total loss of the data the collections held.

The measurement point

Sixty-six and seventeen are small numbers in a dataset where other products in this batch return tens of thousands. Small does not mean unimportant. It means the population is knowable, and a knowable population is one where an operator can move from an external count to an internal decision in a single step.

References

  • PocketBase documentation, https://pocketbase.io/docs/

  • PocketBase project repository, https://github.com/pocketbase/pocketbase

  • ZoomEye AI query results collected 23 October 2026 for app="PocketBase", title="PocketBase", and title="PocketBase" && port="8090", sub-type all