---
type: "post"
id: "building-overexposed-understanding-application-exposure-analysis-8c2f2d"
slug: "building-overexposed-understanding-application-exposure-analysis-8c2f2d"
title: "Building Overexposed: understanding application exposure"
description: "Thesis: Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration."
retrieval_nugget: "Thesis: Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration."
published_at: "2026-10-20"
updated_at: "2026-10-20"
record_date: "2026-10-20"
date_kind: "published_at"
topics: ["security"]
source_urls: ["https://shopify.engineering/overexposed"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:building-overexposed-understanding-application-exposure-analysis-8c2f2d"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:cc0c3293239bda1ea16d411d17ac64799c74062ebfb31d17505154eaf429f30e","reviewed_at":"2026-10-20T00:01:27.041Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration.","observed_facts":[{"text":"Shopify says Overexposed scans GKE Ingresses and Cloud Run services using Google Cloud Asset Inventory and anonymous HTTP probes.","source_urls":["https://shopify.engineering/overexposed"]},{"text":"Shopify reports that about three quarters of results in one early July run were inconclusive.","source_urls":["https://shopify.engineering/overexposed"]},{"text":"The scanner uses six verdicts and retains reasons and evidence while not storing response bodies or credentials.","source_urls":["https://shopify.engineering/overexposed"]}],"mechanism":"Cloud inventory identifies deployed candidates and access policies; anonymous requests test effective reachability; policy and reviewed allowlist context produce a verdict while incomplete evidence remains inconclusive.","why_now":"Shopify says the repository-based approach produced false alarms, misses, and blind spots, and cloud inventory exposed Cloud Run services the earlier scanner did not cover.","implications":["Exposure detection should test effective access instead of treating repository configuration as enforcement.","Explicit inconclusive outcomes and retained evidence support investigation without overclaiming protection."],"evidence_boundary":"The source is Shopify’s engineering account of an internal scanner and one early-run statistic; it provides no independent validation, full performance series, or public availability claim.","watch_conditions":["Watch whether later reports quantify reductions in inconclusive results and measure false-positive rates."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied for this particular scanner or its move from repository configuration to cloud inventory and external probing."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/building-overexposed-understanding-application-exposure-analysis-8c2f2d/","markdown":"https://newruntime.com/posts/building-overexposed-understanding-application-exposure-analysis-8c2f2d.md","json":"https://newruntime.com/posts/building-overexposed-understanding-application-exposure-analysis-8c2f2d.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
---

# Building Overexposed: understanding application exposure

## Retrieval answer

Thesis: Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration.

Thesis: Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration.

Shopify’s Overexposed illustrates the mechanism. Mechanism: Cloud inventory identifies deployed candidates and access policies; anonymous requests test effective reachability; policy and reviewed allowlist context produce a verdict while incomplete evidence remains inconclusive. Shopify says the scanner queries Google Cloud Asset Inventory for deployed GKE Ingress and Cloud Run services, retrieves access policies, and sends anonymous HTTP requests to candidate endpoints. Why now: Shopify says the repository-based approach produced false alarms, misses, and blind spots, and cloud inventory exposed Cloud Run services the earlier scanner did not cover.

Observed facts: Shopify reports that about three quarters of results in one early July run were inconclusive. It says every endpoint is probed even if allowlisted, and that results keep the reason and supporting evidence while omitting response bodies and credentials. First implication: Exposure detection should test effective access instead of treating repository configuration as enforcement. Explicit inconclusive outcomes and retained evidence support investigation without overclaiming protection.

Evidence boundary: The source is Shopify’s engineering account of an internal scanner and one early-run statistic; it provides no independent validation, full performance series, or public availability claim. First watch condition: Watch whether later reports quantify reductions in inconclusive results and measure false-positive rates.

This is a distinct analytical record because no prior New Runtime record was supplied for this particular scanner or its move from repository configuration to cloud inventory and external probing.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)