OpenProject combines project planning, work packages, documents, and user administration. A deployment can be reachable as a normal collaboration site while still containing projects with different confidentiality levels. The login page does not tell an asset owner whether self-registration is enabled, which roles are global, or whether a project is publicly visible.
A count-only ZoomEye search on 2026-10-30 returned 11,686 matches for app="OpenProject" and 12,444 for title="OpenProject" between 06:41 and 06:42 China Standard Time. The result identifies candidate web surfaces, not a list of exposed projects or a count of organizations with weak authentication.
Review authentication and registration first
OpenProject can use internal accounts, LDAP, OpenID Connect, SAML, or Kerberos depending on edition and configuration. Its documentation says administrators can require authentication for access and can configure self-registration. A public site that does not require login may expose project names, work packages, or public projects by design. That design should be deliberate and reviewed per project.
When SSO is added, the local login path may remain for break-glass access. Keep that path narrow and monitored. A break-glass account should have a strong credential, restricted source network, and a review process after use. Do not let an abandoned local account bypass the identity provider without an owner.
SCIM or LDAP group synchronization can remove a user from a group. Check whether the removal also revokes active sessions, API access, and project membership. A user who disappears from an identity provider but retains a token can still read work packages. Test both browser and API access after a group change.
Make project roles match the data
OpenProject uses roles that combine permissions at global and project levels. An administrator has full access, while a project member may have a different set of abilities in each project. Review the role matrix for work-package visibility, attachments, time entries, budgets, and project settings. A role that grants project settings can change who sees the project later, so it should not be granted simply to let someone edit a status field.
Check public projects and public attachments separately. A project may be visible while its files or repository data require a different permission. If guest access is enabled, use a real guest session to enumerate what the UI and API return. Remove fields from public views that were included for internal reporting but not needed by the public audience.
OpenProject can act as an OAuth identity provider for other applications. Treat an OAuth client as a new access path and review its scopes, redirect URI, and owner. A token issued for one integration should not be accepted by an unrelated project or API. Keep the provider metadata and signing keys under the same change control as the application.
Test the publication decision
For each owned title or app match, confirm the host, certificate, login behavior, and deployment owner without reading project data. From outside the management network, verify that a project requiring authentication is inaccessible. From a test account, attempt to open a project outside its role, download an attachment, and access the API with a browser session and a personal token.
Test the registration toggle and the expected email domain. A registration page that appears only after a hidden query parameter is still a registration path. Verify the password-reset flow, invitation expiry, and account lock behavior. Repeat with a disabled user and an expired token.
Review the web server and backup route. Some configuration options can allow administrators to download backups through the web interface. That capability should be restricted to a management network and an explicit administrator role. A backup contains more than the visible project list and should be encrypted and retained like production data.
The 12,444 title matches are a useful discovery hint, not a risk verdict. OpenProject's exposure is shaped by login policy, role inheritance, public projects, and the API. The review should make those decisions visible before treating a reachable collaboration site as low risk.
Query and scope
The standalone SDK requested sub_type=all, page 1, and page size 1, extracting totals only. app="OpenProject" returned 11,686 and title="OpenProject" returned 12,444. Collection ran from 2026-10-29 22:41:56 to 22:42:00 UTC.