Download websites that use Gogs

About Gogs

Source code, issue trackers and pull requests are the inside of an organisation rather than its shopfront. A crawl that reaches them is looking at internal tooling, the place where a team keeps its work, running on hardware the team controls and answering from the open internet either because somebody meant it to or because nobody stopped it. Finding one is a small but real piece of information about how an organisation operates.

The design explains the footprint. Written in Go, the service compiles to a single binary with almost no dependencies, which is why it turns up on modest servers, office machines and hobbyist hardware where a heavier platform would never be attempted. MIT licensing removes the remaining obstacle, since there is nothing to buy and nobody to ask. Software this easy to stand up gets stood up casually, and casually installed software has a habit of running long after the person who installed it has moved on.

As of October 2026 we see 639 hosts running it, carrying 8 distinct version strings between them, the one recorded most often being 0.11.86.0130. Version spread on self-hosted software means something quite different from version spread on a hosted product. Every instance was upgraded by a person, or left alone by a person, so the distribution is a direct readout of maintenance attention across a population of independently administered servers. Vulnerability research, asset inventory and supply chain work all depend on exactly that distribution, and none of them can obtain it by checking hosts one at a time.

The project has existed since 2014 and a later fork grew out of the same codebase, which is worth knowing when reading any count, because the two are separate products that can look similar from outside and our detection keeps them apart.

The undercount here is structural and deserves stating plainly. Instances behind a virtual private network, an identity aware proxy or a plain firewall are invisible to any external crawl, and those are the correctly configured ones. What remains detectable skews towards deployments exposed on purpose, for open source projects and public mirrors, and deployments exposed by accident. The list is a list of publicly reachable instances, which for security research is the interesting subset anyway and for market sizing is a floor rather than a total.

A single lookup can tell you that one company exposes a Git service. The population tells you how common the practice is, which countries and top level domains it concentrates in, which builds are still answering, and whether successive snapshots point up or down.