ResourceSpace manages image, video and document collections for organizations. A public title can belong to a small team site or a large brand library. The system supports browser access and a signed REST API, so the same asset may be reachable through a user session, a user API key, a session key or an external sharing path. A discovery result should lead to a review of those access modes.
On 2026-10-31, a count-only ZoomEye query returned 3 matches for app="ResourceSpace" and 3,749 for title="ResourceSpace". The title query ran at 23:44:55 UTC and the application query at 23:44:53 UTC. Both used sub_type=all, page 1 and page size 1. The large difference is a fingerprint and naming issue, not evidence that 3,749 organizations are exposed. Title matches can include documentation, agencies and public brand pages.
ResourceSpace API requests use a user, a function and parameters, then a signature derived from the user's private key and the query. Authentication modes include a standard user API key, a session key obtained through login, and native browser authentication. The documentation says the API is enabled by default and can be disabled through configuration. A deployment that does not need remote integrations should review that setting rather than leave the surface available by habit.
Keys are identities. A user key inherits the permissions of its account and group. Before trusting an integration, review which collection, metadata and download functions it can call. Rotate keys after staff changes or vendor transitions. Do not put a key in a URL that will be indexed, logged by a proxy or included in an analytics event. The signing scheme protects request integrity, not the confidentiality of a key pasted into a public client.
Collection and group boundaries should be tested with a low-privilege account. Confirm that search results, previews, original downloads and metadata edits follow the intended group membership. External access keys and share links should have an owner, an expiry and a record of the resources they expose. A link intended for review should not remain valid after a campaign or embargo ends.
API logging is useful but can become another sensitive store. The documentation notes that user-key API requests can be recorded in an API log and retained for a configurable period. Protect that log, define a retention period and avoid recording passwords or full request bodies when they are not needed. A support engineer who can read API logs should not automatically be able to download every asset.
The 3,749 title matches should be filtered by context. A public brand site that uses the product name may not be an exposed administration interface. Confirm a candidate by checking the login page, API behavior, collection URLs and any visible version. Then review the organization's own inventory and access policy. A product count is useful for discovery and trending. It does not establish that a specific asset library is accessible.
ResourceSpace is built to distribute assets to many audiences. The security question is whether each distribution path respects the collection decision. Start with remote API enablement, key scope and external sharing. Test those paths with a low-privilege account and keep the evidence with the asset. That is a more useful result than a broad title count alone.