# Shopify Deploys Overexposed for Automated Cloud Infrastructure Security Scanning Shopify shifts from static configuration analysis to live inventory-based probing for cloud exposure. - **Source:** [InfoQ](https://brifing.si/source/68ac18af-a4f3-4f7c-9c2c-44d4af8f89dd) - **Published:** 2026-11-02 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/21041f3a-c684-459d-9ea3-11dd77016197 ## Transitioning from Intent to Enforcement Shopify replaced its initial repository-based scanner with Overexposed, a tool designed to identify internet-accessible GKE Ingresses and Cloud Run services. The original version relied on configuration files, which failed to account for admission controller modifications or resources created outside tracked repositories. The new approach prioritizes actual cluster state over developer intent. ## Leveraging GCP Cloud Asset Inventory The scanner now queries the GCP Cloud Asset Inventory to retrieve live data on Ingresses, load balancers, and Cloud Run services. This method bypasses the need for cluster-specific credentials while ensuring that resources created by platform tooling are visible. By querying the inventory, the team successfully captured services previously invisible to static analysis. ## Anonymous Probing and Verdict Logic Overexposed performs anonymous HEAD and GET requests to validate exposure, following up to three redirects. It categorizes results into six distinct verdicts, including exposed, protected, and inconclusive. By using an allowlist for known endpoints, the scanner reduces noise, though it continues to probe allowlisted items to ensure security controls remain active. ## Contextualizing Status Codes and IAM The tool interprets HTTP status codes based on the specific service environment. For Cloud Run, it distinguishes between IAM-based protection and ingress settings, noting that a 403 response does not inherently prove security. The scanner specifically checks if the allUsers role is assigned or if invoker checks are disabled for public access. ## Refining Inconclusive Results During initial deployment in July, approximately 75% of results were classified as inconclusive. The team iteratively grouped these by failure reason and replayed rule changes against historical data to improve accuracy. By refusing to default to a protected status when evidence is uncertain, the scanner maintains a high level of security integrity. ## Hardening Against SSRF Vulnerabilities Because the scanner initiates outbound requests to arbitrary hostnames, the team implemented strict SSRF protections. It validates DNS-returned IPs, rejects private or loopback addresses, and connects directly to the target IP to prevent DNS rebinding. Additionally, the developers recommend restricting the scanner's network egress to prevent unauthorized access to cloud metadata endpoints. ## AI-Assisted Development and Testing Shopify utilized AI coding agents and automated code reviews to build Overexposed. To ensure the reliability of security guards, the team employed mutation testing and maintained canary targets for each verdict. These practices help verify that the scanner correctly identifies security gaps without passing tests that check the wrong underlying infrastructure components. ## Strategic Implications for Security Teams Shopify's experience highlights the limitations of purely rule-based CI checks, which report intent rather than enforcement. Effective exposure scanning requires combining inventory-based discovery with active probing. Teams should use inventory as the primary reference, reserving probes for instances where configuration analysis cannot confirm if access control policies are being enforced. ## Sources covering this story - https://www.infoq.com/news/2026/11/shopify-kubernetes-ingresses/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=global — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._