Shopify Overexposed: scan the live cloud, not your repo

Shopify's security team learned a lesson the hard way: your repo shows what you meant to deploy, not what is running. Their internal scanner, Shopify Overexposed, finds Google Cloud endpoints that strangers can reach without logging in. It does this by asking the cloud what exists and then knocking on each door. Shopify Engineering wrote it up on October 19, and InfoQ covered it today. The method is cheap enough for a team of three to copy.

What actually happened

Overexposed checks two kinds of internet-facing services: Kubernetes Ingresses on GKE and Cloud Run services.

Version one read config files. It parsed Kubernetes manifests in the infrastructure repo. Shopify says it failed in three ways. It raised false alarms on auth that teams set by hand. It missed changes an admission controller made, because that controller does not run in every cluster. And it could not see Ingresses created from other repos or platform tools.

Version two asks the cloud. A scheduled job queries GCP Cloud Asset Inventory for what is actually deployed. Then it sends one anonymous HTTP request per endpoint, the way an outsider would. That inventory also turned up Cloud Run services in projects the first scanner never covered.

Every endpoint gets one of six verdicts: exposed, expected (open, but on a reviewed allowlist), protected, not found, unreachable or inconclusive. Shopify is blunt that "uncertainty does not mean protected." A 403 from Cloud Run counts as inconclusive, not safe. Early runs came back about three-quarters inconclusive. Within a few weeks of tuning, inconclusive Ingress verdicts dropped by about 80%.

For Cloud Run, the rule is simple: a service is public only if allUsers holds the invoker role or the invoker check is off.

The scanner is guarded too. A tool that requests arbitrary hostnames is an SSRF risk. Shopify checks every resolved IP, rejects private and loopback addresses, and re-checks on each redirect. It also says to block the scanner's egress to internal services and cloud metadata endpoints.

The code itself is internal. Shopify published a reference snapshot as a starting point, not a packaged open-source tool.

Why Shopify Overexposed matters for your business

Your staging URL is probably public. Small teams spin up a Cloud Run preview, a webhook receiver or an admin panel, and forget it. Nobody reviews the IAM binding. A config audit will not catch it if the service came from a console click.

You can run version two this week. List what your cloud says exists, curl each URL with no credentials, and sort the answers. Anything that returns real data without a login and is not on a written allowlist is a ticket.

Sources: Shopify Engineering: Building Overexposed, InfoQ: Shopify Overexposed Scans GKE Ingresses and Cloud Run for Exposure.