Papermark is a document-sharing service built around documents, data rooms, share links, visitors, and analytics. Its public object is often a link rather than a user login. That makes link policy the central security question.

On 9 November 2026 at 08:49 Asia/Shanghai, a ZoomEye query using sub_type=all, page 1, and page size 1 returned 92 assets for app="Papermark". The title query returned 65 and the body query returned 253. The application fingerprint is the primary measurement because it isolates the product better than a generic document-sharing phrase.

The query is reproducible through the selected ZoomEye search.

A share link is an access policy

Papermark documentation describes links with passwords, expiry, email gating, download permission, and per-item permissions inside a data room. Those controls answer different questions. A password limits who can open the link. An expiry limits when the link works. Email gating ties access to an identity. Download permission limits what the viewer can take away.

Review the combination. A link with a password but no expiry can remain useful long after the deal or document review ends. An email-gated link without a verified address may not establish the intended recipient. A data room link with per-item download access needs each item checked, not only the top-level room.

The API documentation describes link creation, update, and revoke operations. Treat link revocation as a workflow with an owner. A document can be deleted while an old link still appears in an email or a browser cache. The security review should include the link inventory, not only the document inventory.

Teams and data rooms add hierarchy

The API returns documents for an authenticated team. Data rooms group documents under one access boundary. Folders can organize standalone documents. A team member may have access to a document through multiple paths.

Test a user who belongs to one team but not another. Attempt to read a document by ID, list a data room, and access a link created by a different team. Confirm that the server checks team membership and object ownership before returning metadata. A generic 404 can be a useful privacy response, but it does not replace the authorization test.

Analytics can expose visitor email addresses, view history, and document activity. Restrict analytics access to the people who need it. Do not send a full visitor record to a marketing tool or a shared dashboard merely because the service can export it.

API credentials need scopes and revocation

Papermark documentation lists OAuth 2.1 and bearer tokens for the REST API and provides scopes such as documents.read, documents.write, links.read, and offline_access. The API can create links and change their permissions. That makes a compromised token a direct sharing risk.

Use the narrowest scope that supports the integration. A reporting integration that only lists documents should not receive write access or link management. Store the token in a secret manager and rotate it when an integration is retired.

Review the OAuth client and redirect URI. A client that can request a broad scope should be treated as a high-value integration. A user should see the requested access and understand which team or data room the grant covers.

A practical review for an owned host

Create a test data room with two documents and two folders. Create one public link, one password-protected link, one email-gated link, and one link with download disabled. Test each link without a session and with the intended identity. Then revoke the links and repeat the same requests.

Use a second team account to test object-level authorization. Try to enumerate a document by changing an identifier, list another team's data room, and access an analytics endpoint. Record the result and the server's response code.

The 92 app matches are an inventory, not proof that a public link contains sensitive documents. For each owned deployment, connect the external link, the team membership, the data-room item permissions, and the API scope. Papermark makes link controls available. The review has to ensure those controls match the document lifecycle.

References