Shopify launches Overexposed scanner to detect exposed GKE and Cloud Run services
The new tool uses Google Cloud Asset Inventory and anonymous probes to move beyond configuration-only checks that miss real-world enforcement.
Shopify has introduced an internal security tool called Overexposed designed to find Kubernetes Ingresses on Google Kubernetes Engine (GKE) and Cloud Run services accessible from the internet without authentication. The scanner was rebuilt after its first version produced too many false alarms and missed resources because it relied solely on configuration files in repositories.
The original scanner checked infrastructure repository config files for public hostnames lacking authentication settings before probing them. Shopify identified three critical failures with this approach: proxy authentication annotations triggered false positives, admission controllers that rewrite settings at creation time were ignored if they didn't run in every cluster, and Ingresses created by other repositories or platform tooling remained unseen.
The team concluded that "the repository shows intent; the cluster shows what is enforced." To solve this, Overexposed now queries Google Cloud Asset Inventory to retrieve accepted GKE Ingresses, along with Cloud Run services and load balancers. A secondary search retrieves access policies without requiring cluster credentials, allowing the tool to surface Cloud Run services in projects…
