Investigate public exposure

What this does

Explain why a resource is publicly reachable. Separate the public entrypoint from the sensitive backing resource, then show the graph evidence that connects them.

Answer four questions:

1. What public surface exists: DNS record, CDN, API gateway, public IP, load balancer, ingress, public policy, public control plane, public database endpoint, or public snapshot/image.
2. What makes it public: internet-facing scheme, public listener, open security rule, anonymous policy, public IAM binding, provider public access flag, public DNS/proxy, or an analysis-job rollup.
3. What is behind it: bucket, instance, database, task/container, pod/container, service, function, or control plane.
4. How confident is the conclusion: direct raw-path evidence, ontology edge, provider rollup only, or partial/stale module coverage.

When to use