Teedy is a document management system that combines document storage, search, user and group permissions, and a REST API. Its deployment defaults deserve attention because a document service can expose business records before an operator has finished configuring users.
The project documentation and README describe guest login and an initial administrator credential in self-hosted examples. Those are setup aids, not a production baseline. A release or container may change defaults, so the operator should confirm the deployed version and configuration rather than assuming one README applies to every build.
Measurement evidence
On 2026-11-07 UTC, page-one count-only ZoomEye probes with sub_type=all returned one match for app="Teedy", 6,718 for title="Teedy" and 137,442 for http.body="Teedy". The title and body counts are much broader than the application fingerprint. They should be treated as discovery leads, not as a population of unauthenticated document servers.
Check guest and administrator paths
Test anonymous access to the base page, search, document listing and document download. Guest read access may be intentional for a public archive, but it should not apply to every collection by accident. Verify the first administrator credential has been changed and that startup environment variables do not recreate a known password during deployment.
Map users, groups and document permissions. Test a user who belongs to one group but not another, then test the API with the same identity. A browser page that hides a button does not prove the API denies the operation. Record share links, document ownership and any external LDAP or OIDC provider.
Treat the API as a separate surface
Programmatic access needs its own token inventory, expiry and revocation path. The project documentation describes REST API access and recent self-hosting guidance describes API-key authentication. Confirm the exact behavior for the deployed version, then test that a revoked token fails and that a disabled user cannot continue through a cached session.
Monitor guest document access, administrator logins, permission changes, failed API calls and large downloads. After an exposure, disable guest access if it is not required, rotate administrator and API credentials, preserve audit logs and review which documents were readable. Changing the page template alone will not remove a direct API path.
The useful record is not just that Teedy is reachable. It is who can read which document and through which interface.