# Public exposure review

A checklist for Terraform, security groups, and buckets that are reachable from the internet.

You are about to merge a network or storage change and want a second pass before it ships.

## What you should get

A short list of resources that accept traffic you did not mean to publish, each with the line that opens it.

## Checklist

- A security group, firewall, or network ACL allows 0.0.0.0/0 or ::/0.
- A management port (22, 3389, 3306, 5432, 6379, 9200, 27017) is reachable from the internet.
- A bucket, blob container, or object ACL grants public read or public write.
- A database sets publicly_accessible, or a data store has a public IP.
- A load balancer or ingress has no source restriction on a private app.
- A comment says the opening is temporary, and the rule is still in the file.

## Public exposure review

Review the infrastructure I paste for public exposure.

Use only the files I give you. If a security group, bucket policy, or database setting is missing, ask for it before you name a finding.

For each finding:
- Quote the resource and the line.
- Say which port, principal, or ACL is open, and from where.
- Say what breaks if that path is closed.
- Give one change and how to check it after apply.

Skip style nits. Skip anything you cannot point at in the text.

The HTML page is https://skaleagents.com/resources/public-exposure-review. Use Actions there to copy the prompt or open it in an assistant.