← Tuesday, October 20, 2026SecurityCase study

Shopify rebuilt its exposure scanner around cloud inventory and endpoint probes

shopify.engineering 8 min read Editor score 7/10

Overexposed inventories GKE Ingresses and Cloud Run services through Cloud Asset Inventory, then probes candidate endpoints for unauthenticated access. The redesign addresses a concrete blind spot: configuration files did not show what was actually running.

What: Overexposed is a scheduled scanner for internet-facing GKE Kubernetes Ingresses and Cloud Run services.
How: It finds deployed services through Cloud Asset Inventory, probes each candidate anonymously, then records a verdict and evidence.
Why it matters: Using cloud inventory reveals what is actually running and enforced, avoiding blind spots and false alarms from relying on configuration files.

Overexposed finds candidate services, probes them, and checks results against its allowlist. Sketched from the article's own text.

Read on shopify.engineering →

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.