Product names that are also common English words create a measurement problem. A title search can find pages that discuss a coder, a code editor, or a coding job. An application fingerprint is narrower and depends on recognizable product evidence. Neither result is a vulnerability count.
On October 30, 2026 UTC, I queried ZoomEye with page size 1 and sub_type=all. The dork app="Coder" returned 15 matches. The dork title="Coder" returned 7,392. Both succeeded. The title total is not a hidden set of Coder platform deployments, and the application total is not a complete census.
Why the title result is so much larger
The word Coder appears in job titles, editor landing pages, documentation, tutorials, and product names. Ordinary title matching is case-insensitive and word-segmented, so it cannot know that the author meant the Coder workspace platform. A strict equality search would reduce some variants but still would not establish product identity.
The application field uses a product fingerprint. It is a better clue for this specific platform, but it can miss deployments with custom pages, reverse proxies, or incomplete evidence. Fifteen matches do not mean only fifteen Coder deployments exist. They mean ZoomEye returned fifteen matches for that exact application query in that scope.
Coder's own security context is substantial. Workspace proxies authenticate users, relay workspace apps, and can reach ports on running workspaces. Workspace apps can use path-based or subdomain-based routes with different browser security contexts. A product title or application match therefore points to a review target, not a risk conclusion.
Use the fingerprint as a scoping tool
The application query is useful for discovering product-specific surfaces. If an owned Coder control plane or proxy appears in that result, compare it with inventory and intended exposure. Check the access URL, proxy token, TLS configuration, workspace sharing level, and token lifetime controls.
The title query is too broad for product ownership claims. It can support a finding about naming noise, but it should not be used to estimate the number of Coder servers. The difference between 15 and 7,392 is not a count of missed fingerprints, and subtraction would produce a meaningless residual.
When comparing snapshots, keep the field stable. A move from title to application is a method change, not a product trend. Preserve the exact quoted value and operator because title="Coder" and title=="Coder" answer different questions.
Verify exposure on owned systems
Start with owned DNS and cloud inventory. For each controlled Coder deployment, verify the public access URL and whether the dashboard is intended to be reachable. Check workspace proxy registration, proxy token storage, TLS, and session lifetime.
Test a non-owner account against shared workspaces and workspace apps. Coder documents differences between subdomain and path-based app sharing and notes that some sharing attributes are not governed by template maximum sharing levels. A public title page does not reveal those settings.
Do not use a broad list of unknown Coder matches as a target population. This is especially relevant for developer tooling because a control plane can lead to source code, build credentials, and internal networks. Authorization and ownership must be established before any verification.
Report the measurement honestly
A useful report states that the application and title fields produce widely different totals because they use different evidence. It can quote both totals with the query time and scope. It can explain why a common word makes title interpretation difficult.
It should not say that there are 7,392 exposed Coder platforms or that 15 application matches are the real global population. The first claim confuses title text with product identity. The second confuses a search result with complete discovery.
The practical conclusion is that product-specific fingerprints should guide an owned inventory review, while broad title terms should be treated as noisy discovery signals. That distinction keeps a large number from turning into a false exposure claim.