LinkAce is a self-hosted bookmark archive. Its records can reveal research interests, internal documentation, customer links, and the URLs people rely on. The service also provides user API tokens and sharing features. A small public footprint can therefore carry a useful map of an organization's information habits.

Observation

At 08:42 on November 4, 2026 (UTC+8), a count-only ZoomEye SDK query with sub_type=all, page 1, and pagesize 1 returned zero application matches for app="LinkAce" and 122 title matches for title="LinkAce". The title matches are a manual verification queue. They may include hosted bookmarks, project pages, or instances with a different application title.

Data and access

The project documentation describes LinkAce as an archive, organizer, and sharing tool for web links. It also documents user API tokens for external applications. Those two facts make the review broader than a login page. A bookmark can be shared without exposing the underlying token, and a token can read or change content without exposing a password. Both need separate ownership.

Start with the account model. Record who administers the instance, how users are created, whether public registration is possible, and which accounts belong to former staff. Then inspect sharing settings. A public or guest-visible collection should be an intentional publication decision, not a side effect of a bookmark's default visibility.

The API review should answer what a token can do. LinkAce's token documentation points to a broad API surface for controlling content. An integration token used by a read-only dashboard should not be able to delete records or change shared collections. If the application does not offer fine-grained scopes, compensate with a dedicated account and network restrictions, and rotate the token when the integration ends.

Review controls

Useful checks include:

  • Identify the owner of every active API token.

  • Test revocation against a read-only integration.

  • Review public, shared, and private bookmark collections.

  • Confirm that backups and exports are not placed in a web root.

  • Check whether link previews or webhooks can be directed at internal services.

  • Record the review time and the visible title count.

The 122 title matches are not evidence of 122 exposed archives. A public page can show a login form, an informational page, or a rendering of the project name. The practical output is a smaller list with a confirmed owner, login boundary, sharing policy, and token inventory.

ZoomEye is useful for finding candidate hosts and for repeating the observation later. It should not be used to inspect private bookmarks or to claim that a public title represents a vulnerable service. The article's conclusion is operational: keep the public face, the sharing decision, and the API authority in the same review, because they describe one information store.

References

  • LinkAce documentation: https://www.linkace.org/docs/

  • LinkAce user API tokens: https://www.linkace.org/docs/v2/configuration/user-api-tokens/

  • ZoomEye title query: https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkxpbmtBY2Ui