Do not leave it. Try to find the owner from deploy history, repository and traffic. If nobody claims it, assign a temporary steward, scan it, and decide within a fixed window whether to adopt, shrink or retire it. An ownerless service that keeps running becomes unpatched exposure.
Why ownerless services matter
OWASP warns that attackers often gain access through old API versions or forgotten endpoints that remain running, unpatched and protected by weaker security, and that missing inventories and retirement plans leave unmaintained systems exposed. An orphan is exactly that: running, with nobody paying attention.
Step 1: find the owner
Look for evidence in this order.
- Catalog entry or labels, if any.
- Repository commit history and code owners file.
- Deploy pipeline and who last triggered it.
- Cloud account or cluster namespace owner.
- Traffic, to find the callers and ask them.
Ask in public. A short message to the engineering channel with the service name and a deadline works better than private guesses.
Step 2: assign a steward
If no owner appears, appoint one. A steward is a team that accepts accountability for scanning, patching and eventual retirement, but not necessarily for feature work. Pick by proximity: the team that calls the service most, or the platform team.
Step 3: scan it
Run a dependency and image scan now, even before the ownership argument ends. You need to know whether it is a quiet leftover or an open door.
Step 4: decide
| Decision | When |
|---|---|
| Adopt | Someone depends on it and wants it |
| Shrink | Needed, but with excess endpoints or data |
| Retire | No callers, or callers can move |
Check traffic before retiring. Turn it off in stages: block, watch for complaints, then delete.
Step 5: set an expiry
Every steward assignment should expire. If nobody has adopted the service by then, it moves to the retirement list. Record the decision in the catalog.
Prevent more orphans
Require an owner field to deploy. Review owners when teams reorganise. Add a quarterly check that every owner resolves to an active team.
Quick check
Can I just shut it off?
Not safely without checking traffic. Block it first, watch for callers, then remove it.
Who pays for a steward's time?
Decide it up front. Otherwise the assignment is ignored. Platform teams often take it as part of their remit.
Safeguard's asset discovery can help find services you did not know about, and a free scan covers one project.
Sources
Last reviewed: 19 October 2026.
