🔓Shopify Open-Sources Overexposed, Cutting Inconclusive Ingress Verdicts By 80%

Your public Ingresses might be open and you wouldn't know

Shopify's security team rebuilt its internal exposure scanner, and the new version finds internet-facing endpoints the old one missed. The tool is called Overexposed. It hunts for Kubernetes Ingresses on GKE and Cloud Run services that anyone can reach without logging in. If you own a GKE cluster or deploy to Cloud Run, this is the kind of tool you want pointed at your own infrastructure. The old version checked the infrastructure repo and probed public hostnames, which meant false alarms and blind spots. The fix was to stop trusting config files and start from what GCP actually has running. Overexposed now queries Cloud Asset Inventory, which includes Ingresses GKE accepts after admission, so it sees what really exists. The numbers matter here. Overexposed sends a HEAD request first, falls back to GET, and follows at most three redirects, rechecking each hop. It returns six verdicts: exposed, expected, protected, not found, unreachable, and inconclusive. Uncertain evidence lands in inconclusive, never protected. Shopify says the rebuild cut inconclusive Ingress verdicts by around 80%. The team also built the thing with AI coding agents and AI code review, then ran mutation testing against its security guards.