Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
DescribeTaskDefinition.taskDefinition.containerDefinitions[].command / entryPoint / healthCheck.command - leaks credential, password, api_key, connection_string
DescribeTaskDefinition.taskDefinition.containerDefinitions[].dockerLabels.<value> - leaks credential, password, api_key, connection_string, sensitive_data
DescribeTaskDefinition.taskDefinition.containerDefinitions[].environment[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeTaskDefinition.taskDefinition.containerDefinitions[].logConfiguration.options.<value> - leaks credential, api_key, bearer_token, connection_string
DescribeAddon.addon.configurationValues - leaks credential, password, api_key, connection_string, sensitive_data
Kubernetes core/v1 ConfigMap.data / binaryData - leaks credential, password, api_key, connection_string, sensitive_data
Kubernetes PodTemplateSpec.containers[].env[].value / command / args - leaks credential, password, api_key, connection_string
CreateReplicationGroup.AuthToken / ModifyReplicationGroup.AuthToken - leaks password, credential
CreateUser.Passwords[] / ModifyUser.Passwords[] - leaks password, credential
CreateListener.Actions[].AuthenticateOidcConfig.ClientSecret / ModifyListener.Actions[].AuthenticateOidcConfig.ClientSecret - leaks secret_key, oauth_token, credential
DescribeRules.Rules[].Actions[].RedirectConfig.{Host,Path,Query} - leaks credential, api_key, bearer_token, sensitive_data
ListBootstrapActions.BootstrapActions[].Args - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeCluster.Cluster.Configurations[].Properties / Configurations[] - leaks credential, password, api_key, connection_string, sensitive_data
S3 or CloudWatch EMR step/bootstrap/application log - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
emr-serverless:GetJobRun.jobRun.jobDriver / configurationOverrides - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeStep.Step.Config.Args / Properties - leaks credential, password, api_key, access_key, secret_key, connection_string
CreateConnection.AuthorizationParameters BasicAuth.Password / ApiKeyAuth.ApiKeyValue / OAuth.ClientParameters.ClientSecret - leaks password, api_key, oauth_token, secret_key, credential
PutEvents request.Entries[].Detail - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
ListTargetsByRule.Targets[].Input / Targets[].InputTransformer.InputTemplate / Targets[].HttpParameters.HeaderParameters / Targets[].HttpParameters.QueryStringParameters - leaks credential, password, api_key, bearer_token, connection_string, sensitive_data
scheduler:GetSchedule.Target.Input - leaks credential, password, api_key, bearer_token, customer_data, sensitive_data
GetPolicy.Policy.SecurityServicePolicyData.ManagedServiceData - leaks credential, api_key, connection_string, sensitive_data
CreateFileSystem.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password - leaks password, credential
CreateStorageVirtualMachine.SvmAdminPassword / UpdateStorageVirtualMachine.SvmAdminPassword - leaks password, credential
GetTable.Table.StorageDescriptor.Parameters / SerdeInfo.Parameters / Table.Parameters - leaks credential, password, connection_string, sensitive_data
GetJob.Job.DefaultArguments / NonOverridableArguments - leaks credential, password, api_key, access_key, secret_key, connection_string
CloudWatch Logs Glue job/crawler log event.message - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
GetJob.Job.Command.ScriptLocation -> S3 object body - leaks source_code_secret, credential, password, api_key, private_key, connection_string
GetWorkflowRunProperties.RunProperties.<value> - leaks credential, password, api_key, connection_string, sensitive_data
CreateLoginProfile.Password / UpdateLoginProfile.Password - leaks password, credential
UploadServerCertificate.PrivateKey - leaks private_key, certificate, credential
GetComponent.component.data - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetContainerRecipe.containerRecipe.dockerfileTemplateData - leaks source_code_secret, credential, password, api_key
GetImageRecipe.imageRecipe.additionalInstanceConfiguration.userDataOverride - leaks credential, password, api_key, access_key, secret_key
GetImageRecipe.imageRecipe.components[].parameters[].value - leaks credential, password, api_key, connection_string
GetWorkflow.workflow.data - leaks credential, password, api_key, source_code_secret
GetFunction.Code.Location -> deployment ZIP contents - leaks source_code_secret, credential, private_key, api_key, password
GetFunctionConfiguration.Environment.Variables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetLayerVersion.Content.Location -> layer ZIP contents - leaks source_code_secret, credential, private_key, api_key, password
GetContainerServiceDeployments.deployments[].containers.<name>.command - leaks credential, password, api_key, connection_string
GetContainerServiceDeployments.deployments[].containers.<name>.environment.<value> - leaks credential, password, api_key, access_key, secret_key, connection_string
CreateInstances.userData / CreateInstancesFromSnapshot.userData - leaks credential, password, api_key, access_key, secret_key, source_code_secret
CreateUser.AuthenticationMode.Passwords[] / UpdateUser.AuthenticationMode.Passwords[] - leaks password, credential
CreateBroker.Users[].Password / UpdateUser.Password - leaks password, credential
DescribeConfigurationRevision.Data - leaks credential, password, api_key, connection_string, sensitive_data
DescribeConfigurationRevision.ServerProperties - leaks credential, password, connection_string, sensitive_data
DescribeApps.Apps[].Environment[].Value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeDeployments.Deployments[].Command.Args.<value> - leaks credential, password, api_key, connection_string
DescribeStacks.Stacks[].CustomJson - leaks credential, password, api_key, connection_string, sensitive_data
CreateDataSource.Credentials.CredentialPair.{Username,Password} / CopySourceArn / SecretArn - leaks password, database_credential, credential, connection_string
CreateDBInstance.MasterUserPassword / ModifyDBInstance.MasterUserPassword / CreateDBCluster.MasterUserPassword / ModifyDBCluster.MasterUserPassword - leaks password, database_credential, credential