Public Exposure Watch¶
A repeatable review that makes changes in public-facing home-lab exposure easier to notice and easier to discuss.
Problem¶
Self-hosted environments can grow quickly. Over time, it becomes easy to lose track of which DNS records exist, which reverse-proxy hosts are configured, which containers publish ports, and whether a new service changed the exposure baseline.
Public exposure should be intentional, documented, and reviewed—not inferred from memory.
Built¶
The workflow creates a focused exposure-review loop:
- Collect DNS records, reverse-proxy host data, and Docker-published port observations.
- Normalize those inputs into one reviewable shape.
- Compare the current run with a stored baseline.
- Classify changes and produce a readable report.
- Deliver the report through an established notification layer and retain selected metrics for dashboarding.
This is a visibility control, not a substitute for a full vulnerability-management or external attack-surface platform.
Evidence¶
Workflow structure
The public portfolio describes collection, review, reporting, and metrics branches without publishing the live editor canvas or integration map.
Alert output
Live notification screenshots, server names, channel structure, counts, and operational findings remain private.
Outcome¶
The workflow provides recurring visibility into public-facing exposure and makes unexpected changes easier to notice. The repeatable baseline is the useful result: each run has context instead of presenting every observation as equally urgent.
Boundaries / what stayed human-approved¶
- A finding is a prompt for review, not an automatic security decision.
- Exposure changes are investigated before remediation or production configuration changes.
- Public screenshots omit IP addresses, internal service names, webhook URLs, private hostnames, and unrelated services.
- No credentials, live endpoints, or private infrastructure identifiers belong in the public case study.