Observability Exposure Checker
Paste Grafana, Prometheus, Loki or Kubernetes config. Get every exposure and its fix.
Your config never leaves this tab.
Background readingCloud misconfigurationsLeaked API keys
What it checks
Grafana, Prometheus, Alertmanager, Loki, Promtail, Alloy, VictoriaMetrics and VictoriaLogs config, plus Kubernetes and compose exposure: open admin endpoints, default or inline credentials, missing auth or TLS, and monitoring ports published to the world.
ConfigMaps and Secrets that embed these files are checked under their key. In-cluster hostnames count as local.
All 56 rules
Observability exposure FAQ
What can I paste in?
Grafana, Prometheus, Alertmanager, Loki, Promtail, Alloy and VictoriaMetrics configs or command lines, Kubernetes manifests, docker-compose and chart values. The format is detected.
Is my config uploaded anywhere?
No. The parser and every rule run in this page.
Where do the rules come from?
Each rule cites the vendor documentation it was checked against, and defaults quoted in a finding come from those pages.
Why is a hardened Prometheus still flagged without a web config?
Without --web.config.file, Prometheus serves its UI and API on 0.0.0.0:9090 with no TLS or login. Behind an authenticating proxy that may be fine, and the finding says so.
Is prom-operator still the kube-prometheus-stack default?
Up to chart 78.x it was; from 79.0.0 Grafana gets a random password. Copied values files still carry it, so it is flagged critical.
Rules reflect the Grafana, Prometheus, Alertmanager, Loki, Alloy, VictoriaMetrics and kube-prometheus-stack documentation as of October 2026. Sample configs on this page are fictional.