Security
Shopify's Overexposed Tool Pinpoints Internet-Facing Kubernetes and Cloud Services
An internal security scanner that combines cloud inventory queries with active probing has cut inconclusive exposure verdicts at Shopify by 80%.
InfoQ
Shopify has developed and open-sourced Overexposed, a scanner designed to surface unauthenticated Kubernetes Ingresses and Cloud Run services accessible over the internet on Google Cloud Platform. Rather than relying solely on configuration files, the tool combines cloud inventory snapshots with active HTTP probing to distinguish what infrastructure intends to be public from what is actually exposed.
Why Config-Only Scanning Falls Short#
The initial version of Overexposed examined infrastructure repositories for Ingresses marked as public, then probed them directly. This approach produced three categories of errors:
- False positives when teams configured authentication through proxy annotations that the scanner didn't recognize
- Blind spots where admission controllers rewrote settings at runtime, meaning a configuration looked correct but had no real effect
- Untracked resources created outside the primary repository, using other tools or platform automation
The core lesson: repository configuration signals intent, while the cluster enforces reality.
A Shift to Inventory-Driven Discovery#
Overexposed was rebuilt around two sources: Google Cloud Asset Inventory and anonymous HTTP validation. The new flow queries the inventory for Ingresses already accepted by GKE (post-admission), Cloud Run services, and load balancers—capturing infrastructure that has actually passed the cluster's controls. A second query retrieves access control policies without requiring cluster credentials.
Each discovered endpoint then receives a single anonymous request: HEAD first, falling back to GET, following up to three redirects. The scanner also tests case-sensitive path variations (such as /ADMIN) and classifies results into six verdicts: exposed, expected, protected, not found, unreachable, and inconclusive.
Nuanced Verdict Logic#
Shopify's team recognized that HTTP status codes mean different things depending on context. A 404 behind an Ingress suggests the reverse proxy answered but the path doesn't exist; the same 404 on Cloud Run might arrive from Google's front end before the application even runs, so it stays inconclusive. A 403 response doesn't automatically mean protection is working.
