Hoppscotch workspaces need a publication and agent boundary

Hoppscotch is an API development and testing client with a self-hosted collaboration option. Workspaces organize collections, environments and team requests. Collections can contain bearer tokens, API keys, certificates and internal hostnames even when the client masks them in the editor.

The self-host documentation describes workspace membership, role-based access control, OAuth providers and domain restrictions. The security notes also distinguish public documentation from the authenticated workspace and describe the local Agent used for requests that need capabilities outside the browser sandbox.

ZoomEye count

At 06:47 Asia/Shanghai on 2026-11-09, the count-only measurement used sub_type=all, page 1 and page size 1:

  • app="Hoppscotch": 1,828
  • title="Hoppscotch": 1,906
  • http.body="Hoppscotch": 776,287

The body count is too broad for a product inventory. The app query is the narrower starting scope. A matching page may be a public landing page, a self-hosted instance or documentation. It does not show whether any workspace contains secrets.

Separate collaboration from publication

Workspace access and public documentation are different data flows. An invitation to a workspace grants collaboration rights. A published collection or environment may be readable without the same session. Review each share action as a publication decision.

Use role separation for owners, editors and viewers. Test a viewer's ability to change environments, invite members, export collections and publish documentation. Revoke access through the identity provider and confirm that an existing browser session ends.

Collections should not store production secrets in plaintext when a secret reference can be used. If a collection must contain a token, provide a short expiry, a dedicated account and a clear owner. Search for examples and environment exports that were copied from a developer workstation.

Treat the Agent as a local relay

The Hoppscotch Agent runs on the user's machine and relays requests that the browser cannot make directly. The security documentation describes a registration handshake with a one-time password and an encrypted channel. That protects the pairing step, but the Agent still has the user's local network reach and any client certificates it is configured to use.

Install the Agent from a trusted source, keep it updated and stop it when it is not needed. Do not pair an Agent on a shared workstation without understanding who can open the local registration flow. A compromised browser page that can reach the relay may gain the same local request capabilities.

Review checklist

  1. List public documentation and the collections behind it.
  2. Search workspace exports for tokens, certificates and private URLs.
  3. Test viewer, editor and owner roles.
  4. Confirm that identity-provider removal revokes active sessions.
  5. Inspect Agent installation and pairing logs on sensitive workstations.
  6. Restrict self-host registration to approved domains or administrators.

Hoppscotch provides useful API collaboration, and the observed app count shows many deployments. The control is to separate workspace access from public publication, scope roles, and treat the local Agent as a trusted endpoint. A collection is a request tool, but it can also be a credential inventory.

References