OpenStatus monitors endpoints and publishes status pages, incidents, reports, and maintenance windows. A status page is designed for an audience, but the dashboard and API that manage it are not. The distinction is especially important when the page contains customer-specific or internal service names.
The ZoomEye measurement on 2026-11-06 used sub_type=all, page 1, and page size 1. app="OpenStatus" returned 0, title="OpenStatus" returned 11, and http.body="OpenStatus" returned 4,002. The title count is a specific lead. The much larger body count is ambiguous and should not be presented as a fleet of exposed dashboards.
Status pages have several access modes
OpenStatus documentation lists public, password, email-domain, and IP-restricted status page access. The dashboard API uses API keys, and the security page describes read and write scopes. The management UI also supports OAuth-based access for some workflows.
Review the page type before deciding whether a public URL is a problem. A public status page may be intentional. An API key with write scope is a different asset. Store it server side, scope it to the needed operations, and rotate it when a person or integration changes.
Separate monitor reachability from audience
A status page can reveal endpoint names, regions, and response patterns. If the service is internal, put the page behind an identity-aware proxy or an IP restriction. Test the page from an unauthenticated network and from an allowed identity. Check whether incident reports or maintenance notes expose customer names, internal hostnames, or the monitoring path.
The API needs its own test. Read-only monitoring queries should not be able to create incidents or change notification channels. Confirm that a key for one workspace cannot operate on another. Review OAuth consent and callback configuration if it is enabled.
Monitor the page and the key
Track status page access changes and key creation as administrative events. Alert on a new public page containing a sensitive hostname or on a write-scoped key used from an unexpected source. Keep a removal process for old incident reports and pages that no longer serve a customer audience.
The 11 title matches are a manageable review set. The 4,002 body matches should be treated as a broad citation search until a hostname and service fingerprint are confirmed.