What problem does it solve? Security testers need a disciplined way to verify whether in-scope serverless functions, event sources, and API Gateway routes expose more than authorized capabilities, without triggering write operations, reading environment variables, or producing false positives from scanner noise. ## Core Features & Use Cases - Evidence-Gated Validation: Enforces a fixed baseline → single-variable probe → post-baseline → oracle → evidence workflow so every finding is backed by cloud audit logs or server-side confirmation. - Strict Safety Boundaries: Stops immediately on management API invocation, IAM changes, function updates, async event delivery, third-party data, or irreversible side effects. - False-Positive Filtering: Treats 404s, cloud headers, WAF blocks, and scanner hits as INCONCLUSIVE, and routes cloud-permission findings to hunt-cloud-misconfig and signature issues to hunt-webhook-signature. - Use Case: During an authorized assessment, confirm whether an anonymous or low-privilege identity can reach your own Lambda function route or canary data that should be restricted, with audit-log proof. ## Quick Start Use $hunt-serverless-exposure to plan an evidence-gated, authorized validation of whether my in-scope serverless routes expose unauthorized capabilities.
