Garage is an S3-compatible distributed object store with a separate administration API. That separation is the useful starting point for an exposure review. The S3 endpoint serves object operations to applications. The Admin API can inspect or change cluster and bucket configuration. Metrics may be another endpoint. A count of pages that mention Garage cannot tell which listener answered or which credential class is in use.
Garage's configuration documentation describes an admin token that has full administrative scope unless replaced by narrower v2 tokens. Dynamic admin tokens can have an expiration and a restricted set of admin API functions. If no static admin token is configured on current versions, only explicitly defined tokens may authorize the admin endpoint. The metrics endpoint may be unauthenticated unless metrics_require_token is set. The admin listener can bind to a Unix socket with restrictive permissions, which reduces network exposure but still requires host-level access control.
A ZoomEye count-only probe on 2026-11-04 returned 19 for app="Garage" and 52,468 for title="Garage", with sub_type=all, page 1, and page size 1. The application count is a narrow lead. The title count is too broad to treat as a deployment census because the word can appear in many unrelated pages. Neither observation shows whether the admin token is configured, whether an S3 key is exposed, or whether a bucket allows public access.
Map the listeners and grants
Inventory the S3, Admin, metrics, and web endpoints by address and port. Bind the Admin API to a management interface or Unix socket and restrict access to the operator account or group. Do not expose it through the same public proxy as object traffic. If metrics are published, require a token or restrict the network path, and review which labels reveal bucket, node, or operation details.
Review admin token scope and lifetime. Replace a static full-scope token where the deployment supports scoped, expiring tokens. Store token files with restrictive permissions and keep them out of configuration backups that are broadly readable. Rotate the token after a host rebuild or administrator departure.
For S3 identities, enumerate access keys, bucket grants, and any public or anonymous bucket policy. Grant only the bucket and operation required by an application. The presence of an S3 key does not mean the key permits every bucket. Conversely, a read-only listing grant may still expose object names and metadata that the application does not need. Test policy changes with a separate key and an unauthorized bucket.
Record the query and its time beside any asset inventory. The application search is the starting point. A title query may find additional leads but should not be used as a count of Garage clusters. Confirm the service type, then inspect only systems owned by the reviewing organization.