By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They

By default though, MongoDB will only listen on localhost and I believe it'll show you a big warning on boot up if you don't have authentication configured. They used to listen on 0.0.0.0 by default but that was fixed many years ago. And this issue doesn't just affect MongoDB - imo since the "webscale" days it's been a favorite to knock on but the public exposure of data happens across many technologies. Here's a comparison with a few others: https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb/ https://blog.shodan.io/elastic-data-exposure-grows-to-3-2-pb...