Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
GetArchiveRule.archiveRule.filter.<criterion>.contains / eq / neq - leaks credential, sensitive_data, pii
GetFindingV2.findingDetails / resource / resourceOwnerAccount - leaks access_key, pii, sensitive_data
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
GetAlternateContact.AlternateContact - leaks pii, sensitive_data
GetContactInformation.ContactInformation - leaks pii, sensitive_data
GetPrimaryEmail.PrimaryEmail - leaks pii, sensitive_data
DescribeCertificate.Certificate.DomainName / Subject / SubjectAlternativeNames - leaks pii, sensitive_data
ListTagsForCertificate.Tags[].Value - leaks credential, sensitive_data
ExportCertificate.PrivateKey - leaks private_key, certificate, credential
ImportCertificate.PrivateKey - leaks private_key, certificate, credential
ListTags.Tags[].Value - leaks credential, sensitive_data
GetCertificateAuthorityCsr.Csr - leaks certificate, pii, sensitive_data
GetCertificate.Certificate / CertificateChain - leaks certificate, pii, sensitive_data
GetApp.app.buildSpec - leaks source_code_secret, credential, password, api_key, connection_string
GetApp.app.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetApp.app.tags.<value> - leaks credential, sensitive_data
GetBranch.branch.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetJob.job.steps[].logUrl -> build log - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetWebhook.webhook.webhookUrl - leaks webhook_secret, credential
CloudWatch Logs API Gateway execution/access log event.message - leaks credential, api_key, bearer_token, session_token, password, pii, sensitive_data
GetIntegration.requestTemplates.<content-type> / GetIntegration.requestParameters.<key> / uri - leaks credential, api_key, password, connection_string, sensitive_data
GetTags.tags.<value> - leaks credential, sensitive_data
GetApiKey.value (includeValue=true) - leaks api_key, credential
GetStage.variables.<value> - leaks credential, password, api_key, connection_string, sensitive_data
apigatewayv2:GetStage.StageVariables.<value> - leaks credential, password, api_key, connection_string, sensitive_data
CreateConnectorProfile.connectorProfileConfig.connectorProfileCredentials - leaks credential, password, api_key, oauth_token, bearer_token, secret_key, connection_string
Configured AppFlow destination records - leaks credential, password, api_key, customer_data, pii
DescribeFlow.sourceFlowConfig.connectorProfileName / sourceConnectorProperties / destinationFlowConfigList[].destinationConnectorProperties / tasks[].taskProperties - leaks credential, connection_string, sensitive_data, pii
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
DescribeRoute.route.spec.httpRoute.match.headers[].match.{exact,prefix,regex,suffix} - leaks credential, api_key, bearer_token, sensitive_data
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.BuildCommand / StartCommand / ImageRepository.ImageConfiguration.StartCommand - leaks credential, password, api_key, connection_string
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.RuntimeEnvironmentVariables / ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables - leaks credential, password, api_key, access_key, secret_key, connection_string
GetNamedQuery.NamedQuery.QueryString - leaks credential, password, api_key, sensitive_data
ExportNotebook.Payload - leaks credential, password, api_key, access_key, secret_key, connection_string, source_code_secret, customer_data
GetPreparedStatement.PreparedStatement.QueryStatement - leaks credential, password, api_key, sensitive_data
GetQueryResults.ResultSet.Rows[].Data[].VarCharValue - leaks credential, password, api_key, customer_data, pii
GetQueryExecution.QueryExecution.Query - leaks credential, password, api_key, sensitive_data, pii
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeAutoScalingGroups.AutoScalingGroups[].Tags[].Value - leaks credential, sensitive_data
DescribeLaunchConfigurations.LaunchConfigurations[].UserData - leaks credential, password, api_key, access_key, secret_key, source_code_secret
DescribeLifecycleHooks.LifecycleHooks[].NotificationMetadata - leaks credential, api_key, sensitive_data
StartRestoreJob recovery point -> restored resource data - leaks credential, password, api_key, private_key, customer_data, source_code_secret
ListTags.Tags.<value> - leaks credential, sensitive_data
GetRecoveryPointRestoreMetadata.RestoreMetadata.<value> - leaks credential, password, connection_string, sensitive_data
GetBackupVaultAccessPolicy.Policy - leaks credential, sensitive_data
DescribeJobDefinitions.jobDefinitions[].parameters / containerProperties.command / eksProperties.podProperties.containers[].command|args - leaks credential, password, api_key, sensitive_data
DescribeJobDefinitions.jobDefinitions[].containerProperties.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
ListTagsForResource.tags.<value> - leaks credential, sensitive_data