Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
ListTags.Tags[].Value - leaks credential, sensitive_data
GetResourcePolicy.ResourcePolicy - leaks credential, sensitive_data
DescribeSecret.Description - leaks credential, sensitive_data, pii
DescribeSecret.Tags[].Value - leaks credential, sensitive_data, pii
BatchGetAutomationRules.Rules[].Actions[].FindingFieldsUpdate.{Note,UserDefinedFields} - leaks credential, password, api_key, sensitive_data
BatchImportFindings request.Findings[] - leaks credential, password, api_key, access_key, pii, sensitive_data, customer_data
ListTagsForResource.Tags.<value> - leaks credential, sensitive_data
ListTagOptions.TagOptionDetails[].Value - leaks credential, sensitive_data, pii
GetEndpointAttributes.Attributes.CustomUserData - leaks credential, sensitive_data, pii
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
GetQueueAttributes.Attributes.Policy - leaks credential, sensitive_data
ListQueueTags.Tags.<value> - leaks credential, sensitive_data
GetOpsItem.OpsItem.OperationalData.<key>.Value - leaks credential, password, api_key, connection_string, sensitive_data, pii
DescribeParameters.Parameters[].Description - leaks credential, sensitive_data
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
identitystore:DescribeGroup.Description - leaks credential, sensitive_data
sso-admin:GetInlinePolicyForPermissionSet.InlinePolicy - leaks credential, sensitive_data
sso-admin:ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
identitystore:DescribeUser.{UserName,DisplayName,Emails[],PhoneNumbers[],Addresses[]} - leaks pii, sensitive_data, credential
CloudWatch Logs Step Functions Express execution log event.message - leaks credential, password, api_key, customer_data, pii, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
DescribeTags.Tags[].Value - leaks credential, sensitive_data
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeScheduledQuery.ScheduledQuery.QueryString - leaks credential, password, api_key, sensitive_data
DescribeTags.Tags[].Value - leaks credential, sensitive_data
DescribeVpcEndpoints.VpcEndpoints[].PolicyDocument - leaks credential, sensitive_data
CloudWatch Logs/S3/Firehose VPC Lattice access log record - leaks credential, api_key, bearer_token, session_token, pii, sensitive_data
GetAuthPolicy.policy - leaks credential, api_key, sensitive_data
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
GetWebACL.WebACL.Rules[].Statement.*.ByteMatchStatement.SearchString - leaks credential, password, api_key, bearer_token, sensitive_data
GetRegexPatternSet.RegexPatternSet.RegularExpressionList[].RegexString - leaks credential, password, api_key, sensitive_data
ListTagsForResource.TagInfoForResource.TagList[].Value - leaks credential, sensitive_data
Microsoft.ContainerInstance/containerGroups.properties.volumes[].azureFile.storageAccountKey - leaks credential, access_key, secret_key
Microsoft.ContainerInstance/containerGroups.properties.containers[].properties.command[] - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.ContainerInstance/containerGroups.properties.containers[].properties.environmentVariables[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.ContainerInstance/containerGroups/containers/logs.content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.ContainerInstance/containerGroups.properties.containers[].properties.environmentVariables[].secureValue - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.ContainerInstance/containerGroups.properties.diagnostics.logAnalytics.workspaceKey - leaks credential, access_key, secret_key
Microsoft.ContainerInstance/containerGroups.properties.imageRegistryCredentials[].password - leaks credential, password
Microsoft.ContainerInstance/containerGroups.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.ContainerInstance/containerGroups.properties.volumes[].secret.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Microsoft.ContainerRegistry/registries.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.ContainerRegistry/registries/tasks.properties.step.*.env[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.ContainerRegistry/registries/runs/listLogSasUrl response.logLink and referenced log - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.ContainerRegistry/registries/tasks/runs request.values[].{value,isSecret} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Data Lake Storage Gen2 Path x-ms-acl, owner, group - leaks sensitive_data, pii
Data Lake Storage Gen2 Path response headers x-ms-properties and metadata - leaks credential, api_key, sensitive_data, pii
Microsoft.Storage/storageAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Kubernetes core/v1 ConfigMap.{data,binaryData} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret