Cloud footprint discovery - S3/Blob/GCS bucket enumeration - Public-facing service identification - Credential exposure hunting (GitHub, Pastebin, etc.)