Shopify Develops Overexposed Scanner for GKE Ingress and Cloud Run Exposure Detection

Introduction of Overexposed Scanner

Shopify has developed and introduced an internal security scanner named Overexposed. This tool is designed to locate Kubernetes Ingresses on Google Kubernetes Engine (GKE) and Cloud Run services that are accessible from the internet without requiring authentication.

Addressing Previous Scanner Limitations

The initial version of the scanner relied on repository configuration files, which led to false alarms and blind spots. This approach failed because proxy authentication annotations could trigger false positives, admission controllers could rewrite settings inconsistently, and Ingresses created by other tools were missed. Shopify concluded that repository configurations show intent, but the cluster reflects what is actually enforced.

The team rebuilt the scanner using GCP Cloud Asset Inventory and an anonymous HTTP probe. This revision significantly improved accuracy, reducing inconclusive Ingress verdicts by approximately 80% within a few weeks of tuning.

Current Scanner Operation

The current Overexposed scanner operates on a schedule, querying Cloud Asset Inventory for Ingresses accepted by GKE, Cloud Run services, and load balancers. It also retrieves access policies without needing cluster credentials. This inventory-based approach also identified Cloud Run services in projects previously outside the scanner's scope.

Each potential candidate service then receives a single anonymous HTTP request. The scanner first sends a HEAD request, falls back to GET, follows up to three redirects, and checks path variations like '/ADMIN'. Results are categorized into six verdicts: exposed, expected, protected, not found, unreachable, and inconclusive. An 'expected' verdict applies to open endpoints that match a reviewed, in-code allowlist entry by exact host and path. Allowlisted endpoints are still probed, and stale entries are flagged.

Contextual Interpretation of Status Codes

Shopify emphasizes that HTTP status codes are interpreted contextually. A 404 status behind an Ingress indicates the proxy responded but the path is missing. For Cloud Run, a 404 from Google's front end before application execution is classified as inconclusive. A 403 status is not considered definitive proof of protection. For Cloud Run, the scanner differentiates between ingress settings and IAM, classifying a service as public only if 'allUsers' holds the 'invoker' role or the invoker check is disabled.