Some software holds data that cannot be rotated. A guided interview that assembles a court filing collects names, addresses, income, medical detail and the narrative of a dispute. None of that can be reset after disclosure, which is why a document-assembly server belongs in the exposure discussion even when the population is small.

The measurement

Run through ZoomEye on 2026-10-23, page size one, all sub-types:

  • app="Docassemble" returned 584.

  • title="Docassemble" returned 2,899.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJEb2Nhc3NlbWJsZSI%3D

The numbers run in the opposite direction from most products in this series, and that inversion is the finding. There are five times as many title matches as fingerprint matches, which tells you the name appears in page titles on sites that are not the application: documentation, training materials, a court's help page, a university's interview gallery. A title query here measures the software's popularity, not its deployment.

The fingerprint is the tighter signal. It matches the application's actual response, so 584 is the better estimate of reachable instances, and even that includes development servers and training environments. Anyone sizing this surface from the title count would overstate it by a factor of five; anyone doing so from a general web search would overstate it by more.

Why the content resists the usual response

Standard incident response for a web application asks whether credentials were exposed and, if so, rotates them. That sequence does not work here. The interview transcript is the sensitive object, and it may include health information, financial detail, the identity of a person seeking protection, and the draft of a legal argument. Rotating a password does not recall any of it.

Three properties make the exposure worse than a comparable content site:

  • Identity linkage. The account is tied to a real person with a real dispute, and the answers describe that dispute in the person's own words.

  • Third-party involvement. The assembled document goes to a court, an agency or an opposing party, so a leak has consequences beyond the platform.

  • Long retention. Drafts persist because the process of revising a filing takes weeks, and nothing expires them once the filing is accepted.

The patterns worth checking

  • Administrator interface reachability. Docassemble ships with an administrative area for managing interviews, users and settings. Whether it is exposed is a per-deployment decision, and stock installations frequently answer on the same host as the public interview.

  • User accounts and saved answers. Interviews offer to save progress. The permission around that saved state is the control that matters, and it is not visible from outside.

  • File uploads. Evidence attachments arrive through the same interface, which means the upload handler sees documents that were never meant to be parsed by a third party.

  • Interview listing. A public index of available interviews describes what an organisation helps people do. That is a modest disclosure on its own and useful reconnaissance in combination.

Where this fits

Legal-aid deployments sit in an awkward position. They serve people who need help and cannot pay for it, which means small budgets, volunteer administration and infrastructure that nobody is funded to review. That profile produces exactly the situation the measurement describes: a modest number of instances, each with a strong reason to exist, and almost no capacity for the review that would put them behind a hardened gateway.

What an operator can do

  • Confirm that the administrative interface is not reachable from the internet, and that the interview host answers only on the path the public needs.

  • Require authentication before an interview is started, rather than only before answers are submitted, so the transcript cannot exist anonymously.

  • Set a retention policy for saved interviews and drafts, and enforce it in the application rather than in a spreadsheet.

  • Encrypt the storage volume holding interview responses, and keep the key outside the container that runs the application.

  • Review who can export data. An export feature turns a permission bug into a bulk disclosure in a single request.

Limitations

ZoomEye totals are an observation, not a census. Crawl coverage varies by geography and address range, the figures drift between queries, and the fingerprint confirms only that the application answered. It says nothing about authentication, retention settings, stored content or patch level, and the population certainly includes training installations that hold no real data at all.

References

  • ZoomEye application fingerprint query for Docassemble, run 2026-10-23, total 584.

  • ZoomEye title query for Docassemble, run 2026-10-23, total 2,899.

  • Docassemble documentation covering user accounts, saved interviews and administrative access.