ToolJet lets teams build internal applications that call databases, APIs, and other services. The login page is the entry point to a workspace where a builder may be able to inspect application definitions, connector configuration, and end-user data. A weak onboarding setting or an overprivileged workspace administrator can expose resources that never appear in the app itself.
ZoomEye count-only queries on 2026-10-30 returned 689 matches for app="ToolJet" and 694 for title="ToolJet" between 06:41 and 06:42 China Standard Time. The small difference is consistent with title and product fingerprint being related but not identical observations. The counts do not establish the authentication state, workspace ownership, or version of any deployment.
Review instance and workspace login together
ToolJet self-hosted authentication can be configured at the instance level and overridden at the workspace level. That flexibility allows different identity providers for different teams, but it also means an instance-wide review is incomplete. Enumerate every workspace, its login method, allowed email domains, sign-up setting, and group synchronization behavior.
ToolJet documentation says self-sign-up can be enabled and that users may join a workspace without a personal invitation. If that behavior is not intended, disable it or restrict it to approved domains. Consider what happens when an identity provider removes a user. Some identity documents require an administrator to archive the user in ToolJet after deletion from the provider. Record that manual step or replace it with a tested provisioning process.
Two-factor authentication is an available control for password accounts, but it must be enabled and each user must configure it. Enabling the feature does not automatically enforce it for everyone. If the workspace relies on SSO, review the token audience, issuer, domain restriction, and role mapping rather than treating the presence of an SSO button as proof of strong authorization.
Inventory what an app identity can reach
A ToolJet app can hold connector credentials, query definitions, workflow actions, and constants. Treat the workspace as a secret-bearing system. Limit builder access to the people who can change those definitions, and separate builder roles from end-user roles. Check custom groups and their permissions after every identity-provider synchronization.
Workspace constants set through environment variables take precedence over a constant with the same name in the UI. That precedence is useful for deployment control, but it can surprise an administrator who edits the visible value and sees no effect. Document the source of each constant and avoid using it for values that should be different per tenant. A secret in a browser-visible app definition is not a secret.
Workflows can execute code and reach external services. Restrict the worker network, review outbound destinations, and isolate high-risk connectors. A general-purpose internal tool platform can become a bridge between a low-sensitivity user and a high-sensitivity database. The connector's database role should allow only the operations the app needs.
Test the real workspace boundary
For an owned match, verify the response title, authentication page, and host owner without submitting credentials. From outside the management network, confirm the expected block. From inside, create a test workspace with two users and a lower-privileged end user. Attempt to open another workspace's settings, edit an app, execute a connector action, and read an app constant.
Repeat the test after a group synchronization, a user archive, and an invitation resend. A user who is removed from the identity provider may still have a valid ToolJet session until the application expires it. Verify the session timeout and revocation behavior. Test password reset and recovery as a separate path.
Review backups for connector credentials and app data. A backup may contain both even if the live dashboard masks them. Use encryption, restrict restore access, and rotate credentials after a restore to a lower environment. Keep an inventory of the workspace's outbound services so a later connector change can be reviewed against the same allowlist.
The observed counts are a discovery hint. ToolJet's risk is not simply that a login page is reachable. It is the combination of workspace enrollment, builder authority, connector secrets, and data returned to end users. The deployment should make those pieces independently observable.
Query and scope
The standalone SDK requested sub_type=all, page 1, and page size 1, extracting totals only. app="ToolJet" returned 689; title="ToolJet" returned 694. Collection ran from 2026-10-29 22:41:34 to 22:41:36 UTC.