1538 Jenkins, 169 Harbor and 32 SonarQube Results: The Build Chain Has a Public Address

Build and release tooling holds the credentials that deploy to production. It is also frequently reachable from the internet, because it was stood up quickly for a project and never moved behind the perimeter. A ZoomEye query set collected on 22 September 2026 returned:

Query Total results

app:"Jenkins" 1,538

app:"Harbor" 169

app:"SonarQube" 32

app:"Portainer" 943,412

app:"Grafana" 603,672

Portainer and Grafana are included for scale comparison. The build-chain tools are the smaller numbers, and the smaller numbers are the ones that hold deployment credentials.

Why the build chain is a high-value target

A CI server is not a normal application. It has, by design, the ability to execute code, to read source repositories, to access artefact registries, and to deploy to production environments.…