Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
cloudfunctions.projects.locations.functions.get.description - leaks credential, api_key, sensitive_data, pii
cloudfunctions.projects.locations.functions.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
storage.objects.get.metadata.<value> - leaks credential, api_key, sensitive_data, pii
storage.buckets.getIamPolicy.bindings[].{members[],condition} - leaks pii, sensitive_data
storage.buckets.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
storage.objects.get.metadata.<value> - leaks credential, api_key, sensitive_data, pii
container.projects.zones.clusters.get.resourceLabels.<value> - leaks credential, api_key, sensitive_data, pii
iam.projects.roles.get.{title,description} - leaks credential, api_key, sensitive_data, pii
iam.policies.get.rules[].denialCondition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
iam.policies.get.rules[].denyRule.{deniedPrincipals[],exceptionPrincipals[]} - leaks pii, sensitive_data
cloudresourcemanager.projects.getIamPolicy.bindings[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.getIamPolicy.bindings[].members[] - leaks pii, sensitive_data
iap.getIamPolicy.bindings[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
iap.getIamPolicy.bindings[].members[] - leaks pii, sensitive_data
cloudkms.projects.locations.keyRings.cryptoKeys.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
compute.sslCertificates.get.certificate - leaks certificate, sensitive_data
logging.entries.list.entries[].{labels.<value>,resource.labels.<value>,httpRequest} - leaks credential, pii, sensitive_data
logging.projects.metrics.get.{filter,labelExtractors.<value>,description} - leaks credential, api_key, sensitive_data, pii
logging.projects.locations.savedQueries.get.loggingQuery.filter - leaks credential, pii, sensitive_data
logging.projects.sinks.get.{filter,destination} - leaks sensitive_data, pii
redis.projects.locations.instances.get.{redisConfigs.<value>,labels.<value>,displayName} - leaks credential, api_key, sensitive_data, pii
monitoring.projects.alertPolicies.get.{documentation.content,conditions[],userLabels.<value>} - leaks credential, pii, sensitive_data
monitoring.projects.dashboards.get.{displayName,labels.<value>,mosaicLayout/gridLayout/rowLayout/columnLayout.widgets[]} - leaks credential, pii, sensitive_data
networkconnectivity.projects.locations.global.hubs.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
networkconnectivity.projects.locations.spokes.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
networkconnectivity.projects.locations.spokes.get.{linkedVpnTunnels.uris[],linkedInterconnectAttachments.uris[],linkedRouterApplianceInstances.instances[]} - leaks sensitive_data
orgpolicy.projects.policies.get.spec.rules[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
orgpolicy.projects.policies.get.spec.rules[].values.{allowedValues[],deniedValues[]} - leaks sensitive_data
compute.disks.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
compute.snapshots.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
compute.forwardingRules.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
compute.serviceAttachments.get.{consumerAcceptLists[],consumerRejectLists[],domainNames[]} - leaks sensitive_data, pii
compute.serviceAttachments.get.{description,metadata.<value>} - leaks credential, api_key, sensitive_data, pii
pubsub.projects.schemas.get.definition - leaks source_code_secret, credential, password, api_key, private_key
pubsub.projects.topics.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.folders.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.organizations.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.securityHealthAnalyticsSettings.customModules.get.customConfig.{predicate,customOutput.properties,resourceSelector,description} - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.sources.findings.list.listFindingsResults[].finding.{description,eventTime,externalUri} - leaks pii, sensitive_data
securitycenter.organizations.muteConfigs.get.{filter,description} - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.notificationConfigs.get.streamingConfig.filter - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.get.annotations.<value> - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.addVersion.request.payload.data - leaks credential, password, api_key, private_key, sensitive_data
iam.projects.serviceAccounts.get.{displayName,description} - leaks credential, api_key, sensitive_data, pii
sourcerepo.projects.repos.get.{name,url} - leaks sensitive_data
spanner.projects.instances.databases.getDdl.statements[] - leaks credential, sensitive_data
spanner.projects.instances.get.labels.<value> - leaks credential, api_key, sensitive_data, pii