Dawarich is a self-hosted location-history application described by its project as a privacy-focused alternative to hosted timeline services. It can ingest location points from mobile clients and display tracks, visits, and statistics. That makes an exposed instance a personal-data problem even when the visible login page is simple.

Observation

At 08:42 on November 4, 2026 (UTC+8), a count-only ZoomEye SDK query with sub_type=all, page 1, and pagesize 1 returned zero application matches for app="Dawarich" and 581 title matches for title="Dawarich". The title count is a lead list, not a confirmation that every host is a reachable Dawarich deployment. Documentation pages and renamed instances can contribute to the result.

API and sharing boundary

The official location-tracking guide says the mobile clients connect with a server URL and an API key found in the account settings. The API documentation lists endpoints for location data, tracks, visits, and statistics. Those endpoints make authentication and object-level authorization more important than the appearance of the public homepage.

The review should first identify which API and ingestion routes are internet-facing. A mobile ingest endpoint may need to accept requests from many networks, while administration and export routes should be narrower. If a reverse proxy protects the dashboard but leaves the API reachable directly, the boundary is incomplete.

API keys deserve a short lifetime and an owner. Test whether a revoked key stops all read and write paths, including background imports and share links. Review the available sharing features, especially any history window that can expose locations from before the recipient's request. A share link should have an expiry and a clear owner.

Privacy review

Additional checks include:

  • Inventory API keys and mobile clients.

  • Test access to another user's tracks by changing identifiers.

  • Confirm that map tiles or external geocoding do not receive more precise data than intended.

  • Review database and export retention.

  • Check whether the service is indexed or reachable from a public network by design.

  • Record the query time and result scope for future comparison.

The data can reveal home, work, travel, and health-related routines. A public title that looks harmless should not be dismissed. At the same time, the 581 title matches do not prove that 581 people's locations are exposed. The next step is a controlled owner check: confirm the host, login boundary, API route, and sharing policy without collecting location records.

ZoomEye is useful for discovering candidate deployments and repeating the public observation. It cannot validate consent, retention, or object-level authorization. Those are application-level questions that need a test account and an operator who can explain why each API path exists.

The practical outcome is a personal-data inventory with a named owner and a revocation path. Location services become safer when the API key is treated like a key to a history, not just a token for a mobile app.

References

  • Dawarich location tracking guide: https://dawarich.app/docs/getting-started/track-your-location/

  • Dawarich API documentation: https://dawarich.app/docs/api/dawarich-api/

  • ZoomEye title query: https://www.zoomeye.ai/searchResult?q=dGl0bGU9IkRhd2FyaWNoIg%3D%3D