WriteFreely Instances: 49 Title Matches Raise Admin Claim and API Token Concerns

ZoomEye returned 49 title matches for WriteFreely on November 4, 2026, but none for the application fingerprint, so the count may not capture full coverage. Researchers note that in some WriteFreely setups the first user to log in becomes administrator, which is risky if an instance is exposed before that role is claimed. Operators are advised to confirm admin status, check whether federation and open registration are enabled, and ensure anonymous visitors cannot create a second admin path. API tokens tied to publishing accounts should be inventoried, kept out of public code, rotated when contributors leave, and kept out of logs. The 49 results are presented as a bounded set for owners to compare against their own domain inventories, not as a confirmed vulnerability list.