Building Overexposed: understanding application exposure

Which applications have internet exposure? Which endpoints allow access without authentication? Public access can be intentional. The challenge is to understand it and check whether it matches policy. Applications can run across many teams and cloud services. As these applications change, keeping track of their internet exposure and access controls requires regular checks. We built a scanner called Overexposed to solve for this. It checks two types of internet-facing services: Kubernetes Ingresses on Google Kubernetes Engine (GKE), and Cloud Run services. It starts with the cloud’s inventory of deployed services, then checks whether each candidate allows access without a login. For every candidate endpoint, it gives a verdict and a reason. Ask the cloud what is running: The scanner uses GCP’s Cloud Asset Inventory API to find deployed Kubernetes Ingresses and Cloud Run services that might be reachable from the internet. Probe like a stranger: For every…