Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
ImportCertificate.PrivateKey - leaks private_key, certificate, credential
GetApp.app.buildSpec - leaks source_code_secret, credential, password, api_key, connection_string
GetApp.app.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetBranch.branch.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetJob.job.steps[].logUrl -> build log - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetIntegration.requestTemplates.<content-type> / GetIntegration.requestParameters.<key> / uri - leaks credential, api_key, password, connection_string, sensitive_data
GetStage.variables.<value> - leaks credential, password, api_key, connection_string, sensitive_data
apigatewayv2:GetStage.StageVariables.<value> - leaks credential, password, api_key, connection_string, sensitive_data
CreateConnectorProfile.connectorProfileConfig.connectorProfileCredentials - leaks credential, password, api_key, oauth_token, bearer_token, secret_key, connection_string
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.BuildCommand / StartCommand / ImageRepository.ImageConfiguration.StartCommand - leaks credential, password, api_key, connection_string
DescribeService.Service.SourceConfiguration.CodeRepository.CodeConfiguration.CodeConfigurationValues.RuntimeEnvironmentVariables / ImageRepository.ImageConfiguration.RuntimeEnvironmentVariables - leaks credential, password, api_key, access_key, secret_key, connection_string
ExportNotebook.Payload - leaks credential, password, api_key, access_key, secret_key, connection_string, source_code_secret, customer_data
DescribeLaunchConfigurations.LaunchConfigurations[].UserData - leaks credential, password, api_key, access_key, secret_key, source_code_secret
DescribeLifecycleHooks.LifecycleHooks[].NotificationMetadata - leaks credential, api_key, sensitive_data
DescribeJobDefinitions.jobDefinitions[].parameters / containerProperties.command / eksProperties.podProperties.containers[].command|args - leaks credential, password, api_key, sensitive_data
DescribeJobDefinitions.jobDefinitions[].containerProperties.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeJobs.jobs[].parameters / container.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value - leaks credential, password, api_key, connection_string
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[Namespace=aws:elasticbeanstalk:application:environment].Value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeApplicationVersions.ApplicationVersions[].SourceBundle -> S3 object body - leaks source_code_secret, credential, private_key, api_key, password
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[].Value (TemplateName) - leaks credential, password, api_key, connection_string
bedrock-agent:GetAgentActionGroup.agentActionGroup.apiSchema.payload / functionSchema - leaks credential, api_key, connection_string, source_code_secret, sensitive_data
bedrock-agent:GetAgent.agent.instruction / promptOverrideConfiguration - leaks credential, password, api_key, customer_data, pii, source_code_secret
bedrock-agent:GetPrompt.variants[].templateConfiguration - leaks credential, password, api_key, customer_data, pii, source_code_secret
DescribeStacks.Stacks[].Parameters[].ParameterValue - leaks credential, password, api_key, access_key, secret_key, connection_string, sensitive_data
GetTemplate.TemplateBody (Parameters.Default, Metadata, Mappings, Resources properties, Outputs) - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret
GetFunction.FunctionCode - leaks source_code_secret, credential, password, api_key
GetDistributionConfig.DistributionConfig.Origins.Items[].CustomHeaders.Items[].HeaderValue - leaks credential, api_key, bearer_token, password
CloudHSM CLI user create/change-password password input - leaks password, credential
GetDashboard.DashboardBody - leaks credential, api_key, bearer_token, connection_string, sensitive_data
CloudWatch Logs/S3 CodeBuild log content - leaks credential, password, api_key, access_key, secret_key, private_key, source_code_secret
BatchGetBuilds.builds[].environment.environmentVariables[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
BatchGetProjects.projects[].source.buildspec / projects[].secondarySources[].buildspec - leaks source_code_secret, credential, password, api_key, connection_string
BatchGetProjects.projects[].environment.environmentVariables[type=PLAINTEXT].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Target host or Lambda deployment CloudWatch Logs event.message - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetDeployment.deploymentInfo.revision.appSpecContent.content - leaks source_code_secret, credential, password, api_key, connection_string
GetDeployment.DeploymentInfo.Revision.S3Location / GitHubLocation -> revision files - leaks source_code_secret, credential, password, api_key, private_key, connection_string
GetPipeline.pipeline.stages[].actions[].configuration.<value> - leaks credential, password, api_key, oauth_token, connection_string, sensitive_data
GetPipeline.pipeline.variables[].defaultValue - leaks credential, password, api_key, connection_string, sensitive_data
DescribeRemediationConfigurations.RemediationConfigurations[].Parameters.<name>.StaticValue.Values[] - leaks credential, password, api_key, connection_string, sensitive_data
DescribeConfigRules.ConfigRules[].InputParameters - leaks credential, password, api_key, sensitive_data
GetPipelineDefinition.pipelineObjects[].fields[].stringValue / refValue - leaks credential, password, api_key, access_key, secret_key, connection_string, database_credential
GetPipelineDefinition.parameterValues[].stringValue - leaks credential, password, api_key, connection_string, sensitive_data
CreateDBCluster.MasterUserPassword / ModifyDBCluster.MasterUserPassword - leaks password, database_credential, credential
ConnectDirectory.ConnectSettings.Password - leaks password, database_credential, credential
CreateMicrosoftAD.Password / ResetUserPassword.NewPassword - leaks password, credential
CreateTrust.TrustPassword - leaks password, credential
DescribeInstanceAttribute.UserData.Value (Attribute=userData) - leaks credential, password, api_key, access_key, secret_key, source_code_secret
DescribeLaunchTemplateVersions.LaunchTemplateVersions[].LaunchTemplateData.UserData - leaks credential, password, api_key, access_key, secret_key, source_code_secret
BatchGetImage.images[].imageManifest - leaks source_code_secret, credential, password, api_key, sensitive_data
DescribeTasks.tasks[].overrides.containerOverrides[].environment[].value / command - leaks credential, password, api_key, connection_string