Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
GetFindingV2.findingDetails / resource / resourceOwnerAccount - leaks access_key, pii, sensitive_data
Configured AppFlow destination records - leaks credential, password, api_key, customer_data, pii
GetQueryResults.ResultSet.Rows[].Data[].VarCharValue - leaks credential, password, api_key, customer_data, pii
StartRestoreJob recovery point -> restored resource data - leaks credential, password, api_key, private_key, customer_data, source_code_secret
bedrock-runtime InvokeModel/Converse request body and response body - leaks credential, password, api_key, customer_data, pii, source_code_secret, sensitive_data
cloudfront-keyvaluestore:GetKey.Value - leaks credential, password, api_key, bearer_token, sensitive_data
GetQueryResults.QueryResultRows[].<field> - leaks credential, password, api_key, session_token, pii, sensitive_data
LookupEvents.Events[].CloudTrailEvent (requestParameters / responseElements / additionalEventData) - leaks credential, password, api_key, bearer_token, session_token, pii, sensitive_data
logs:FilterLogEvents.events[].message - leaks credential, password, api_key, access_key, secret_key, oauth_token, bearer_token, private_key, connection_string, customer_data, pii
logs:GetQueryResults.results[][].{field,value} - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
GetPackageVersionAsset.asset - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key, connection_string
GetFile.fileContent - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key, connection_string
cognito-sync:ListRecords.Records[].Value - leaks customer_data, sensitive_data, credential
SelectResourceConfig.Results[] - leaks credential, password, api_key, pii, sensitive_data
SelectAggregateResourceConfig.Results[] - leaks credential, password, api_key, pii, sensitive_data
BatchGetResourceConfig.baseConfigurationItems[].configuration / supplementaryConfiguration - leaks credential, password, api_key, connection_string, pii, sensitive_data
ListIndicators.Indicators[].IndicatorDetail - leaks access_key, pii, sensitive_data, customer_data
MongoDB find/aggregate response documents - leaks credential, password, api_key, session_token, connection_string, customer_data, pii
Scan.Items[].<attribute-name> - leaks credential, password, api_key, access_key, secret_key, connection_string, customer_data, pii
dynamodbstreams:GetRecords.Records[].dynamodb.NewImage / Records[].dynamodb.OldImage - leaks credential, password, api_key, customer_data, pii
GetSnapshotBlock.BlockData - leaks credential, password, api_key, access_key, secret_key, private_key, customer_data, source_code_secret
GetDownloadUrlForLayer.downloadUrl -> layer tar contents - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key
Mounted EFS file bytes - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, customer_data, source_code_secret
Redis GET/MGET/SCAN or Memcached get response value - leaks credential, password, api_key, session_token, connection_string, customer_data
Mounted FSx file or object bytes (SMB/NFS/Lustre/ONTAP/OpenZFS) - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, customer_data, source_code_secret
GetFindings.Findings[] - leaks access_key, pii, sensitive_data, customer_data
GetIPSet.Location -> S3 object body - leaks sensitive_data, pii, credential
GetThreatIntelSet.Location -> S3 object body - leaks sensitive_data, pii
GetCisScanReport.url -> PDF/CSV report - leaks pii, sensitive_data, customer_data
ListFindings.findings[] - leaks pii, sensitive_data, source_code_secret
CQL SELECT result rows - leaks credential, password, api_key, session_token, connection_string, customer_data, pii
GetRecords.Records[].Data - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
GetWorkUnitResults.ResultStream - leaks credential, password, api_key, customer_data, pii
GetFindings.findings[].classificationDetails.result.sensitiveData / resourcesAffected - leaks pii, sensitive_data, customer_data
Redis OSS GET/MGET/SCAN response value - leaks credential, password, api_key, session_token, connection_string, customer_data
AMQP/JMS/STOMP/MQTT message body and headers - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
Kafka consumer record key/value/headers - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
Neptune HTTPS Gremlin/SPARQL/openCypher query result body - leaks credential, password, api_key, customer_data, pii
Neptune Streams records - leaks credential, password, api_key, customer_data
OpenSearch _search/_mget response _source fields - leaks credential, password, api_key, bearer_token, customer_data, pii, sensitive_data
OpenSearch Serverless _search response _source fields - leaks credential, password, api_key, customer_data, pii
ExportJournalToS3 output S3 objects - leaks credential, password, api_key, customer_data, pii
qldb-session:SendCommand.ExecuteStatement.Result.FirstPage.Values[] - leaks credential, password, api_key, customer_data, pii
rds-data:ExecuteStatement.records / formattedRecords - leaks credential, password, api_key, connection_string, customer_data, pii
redshift-data:GetStatementResult.Records - leaks credential, password, api_key, customer_data, pii
GetObject.Body - leaks credential, password, api_key, access_key, secret_key, oauth_token, private_key, connection_string, customer_data, source_code_secret
Notebook Instance or Studio EFS home-directory files - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret, customer_data
GetFindings.Findings[].{Note.Text,UserDefinedFields,Resources[].Details.Other,Description,Remediation.Recommendation.Text} - leaks credential, password, api_key, access_key, pii, sensitive_data, customer_data
ReceiveMessage.Messages[].MessageAttributes[].StringValue / BinaryValue - leaks credential, api_key, bearer_token, sensitive_data, pii
ReceiveMessage.Messages[].Body - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, customer_data, pii