Shopify’s Overexposed illustrates the mechanism.
This is a distinct analytical record because no prior New Runtime record was supplied for this particular scanner or its move from repository configuration to cloud inventory and external probing.
Thesis
Exposure scanning is more reliable when it tests deployed reality from an outsider’s position rather than inferring access from source configuration.
Observed facts
Shopify says Overexposed scans GKE Ingresses and Cloud Run services using Google Cloud Asset Inventory and anonymous HTTP probes.
1Shopify reports that about three quarters of results in one early July run were inconclusive.
1The scanner uses six verdicts and retains reasons and evidence while not storing response bodies or credentials.
1
Mechanism
Cloud inventory identifies deployed candidates and access policies; anonymous requests test effective reachability; policy and reviewed allowlist context produce a verdict while incomplete evidence remains inconclusive.
Why now
Shopify says the repository-based approach produced false alarms, misses, and blind spots, and cloud inventory exposed Cloud Run services the earlier scanner did not cover.
Implications
Exposure detection should test effective access instead of treating repository configuration as enforcement.
Explicit inconclusive outcomes and retained evidence support investigation without overclaiming protection.
Evidence boundary
The source is Shopify’s engineering account of an internal scanner and one early-run statistic; it provides no independent validation, full performance series, or public availability claim.
Watch conditions
Watch whether later reports quantify reductions in inconclusive results and measure false-positive rates.