InfoQ: Shopify Overexposed Scans GKE Ingresses and Cloud Run for Exposure
Shopify has built Overexposed, an internal scanner that finds GKE Ingresses and Cloud Run services reachable from the internet without authentication. The first version read repository config and produced false positives and blind spots, so the team rebuilt it on GCP Cloud Asset Inventory plus a single anonymous HTTP probe per candidate. Shopify says tuning over a few weeks cut inconclusive Ingress verdicts by about 80%.
What changes for platform teams
Platform teams on GKE or Cloud Run can use cluster and cloud inventory as the source of truth for exposure, since repository config can differ from what admission controllers enforce. Shopify's guidance is to keep config analysis in CI as an early signal and add live probes only where inventory cannot confirm access control.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules