Wanderer is a self-hosted trail catalogue with a web frontend, PocketBase backend, and Meilisearch service. Its documentation describes a useful set of defaults, including disabled signup and a private-instance option. The same documentation shows why a public banner is a weak proxy for the application's effective access policy.

On 9 November 2026 at 08:49 Asia/Shanghai, a ZoomEye query using sub_type=all, page 1, and page size 1 returned 160 assets for app="Wanderer". The title query returned 1,284 and the body query returned 18,137. The higher title count includes pages that are not necessarily the same product, so the application fingerprint is the primary measurement.

The query is reproducible through the selected ZoomEye search.

Public signup is a separate decision

Wanderer's environment documentation lists PUBLIC_DISABLE_SIGNUP with a default of false. It also lists PUBLIC_PRIVATE_INSTANCE, which can block visitors from viewing content without an account. The first setting controls account creation. The second controls content visibility for anonymous visitors.

A deployment can disable signup and still expose public content. It can allow signup and remain private to unauthenticated visitors. The two settings should be documented separately. A single "private instance" label does not tell an operator whether a new user can create an account.

Review the first-login and invitation process. If signup is enabled, test what a new account can see and change before any administrator approval. If signup is disabled, confirm that a deleted user cannot self-register back into the service.

Frontend-to-backend trust is a proxy problem

The environment documentation describes a POCKETBASE_PROXY_SECRET shared by the frontend and backend. It protects inbound ActivityPub delivery and fails closed when unset. It does not authenticate arbitrary client-IP headers.

Wanderer also documents forwarding-header settings. If the application trusts X-Forwarded-For from a path that an external client can control, the address used for rate limiting or policy can be forged. Put the web service behind a controlled proxy, block direct access to the service port, and overwrite the forwarding header at the edge.

The XFF_DEPTH setting should match the trusted proxy chain. A value chosen by guesswork can select an attacker-controlled address from the left side of a header. Test rate limiting and audit logs from inside and outside the network.

Secrets have different lifetimes

Wanderer's installation guide requires a Meilisearch master key, a PocketBase encryption key, and a proxy secret. The encryption key is used to encrypt stored secrets. The documentation warns that changing it after first start can make stored data undecryptable. The proxy secret authenticates the frontend-to-backend hop and should match on both services.

These are not interchangeable API tokens. Record where each secret is stored, which services consume it, and how it is rotated. A copied .env file or a compose file with default example values can expose the instance even when the application login page looks healthy.

Review the PocketBase search service separately. Meilisearch is not the public web frontend. If its port is reachable directly, a user may query data without passing through the frontend's access rules. Network policy should restrict the search service to the application tier.

Test the application as three roles

Use an anonymous visitor, a normal user, and an administrator. For each role, check the public trail list, a private route, account settings, uploads, and API token creation. Confirm that the frontend and the backend return the same authorization decision.

ActivityPub delivery adds a federation boundary. Test whether an inbound delivery reaches the expected handler and whether a malformed or unauthenticated request is rejected. Do not expose the backend merely because the frontend requires a secret.

The 160 app matches are an inventory, not a claim that every Wanderer instance is misconfigured. The useful next step is to compare signup, private-instance mode, proxy trust, and secret placement on each owned host. Wanderer's design gives operators the controls. The deployment has to make those controls agree with the intended audience.

References