Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.App/containerApps.properties.template.containers[].env[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps.properties.configuration.dapr and Dapr component metadata - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DocumentDB/databaseAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Cosmos DB scripts storedProcedures[].body, triggers[].body, userDefinedFunctions[].body - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks cluster.{spark_conf,spark_env_vars,custom_tags,init_scripts} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks global init script response.script - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks jobs runs get-output response.{notebook_output.result,logs,error,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Databricks job.settings.tasks[].{notebook_task,spark_python_task,spark_jar_task,spark_submit_task,sql_task,run_job_task} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks Workspace export content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Microsoft.Databricks/workspaces.tags.* - leaks credential, api_key, sensitive_data, pii
Databricks Secrets put request.{string_value,bytes_value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Data Factory activity run.{input,output,error} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.DataFactory/factories/globalParameters.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.DataFactory/factories/linkedservices.properties.typeProperties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key
Microsoft.DataFactory/factories/pipelines.properties.{parameters,variables,activities} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.DataFactory/factories.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DataFactory/factories/triggers.properties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Security/assessments properties.{displayName,status,resourceDetails,additionalData,links} - leaks sensitive_data, pii, customer_data
Microsoft.Security/automations properties.{sources,actions,scopes,description} - leaks credential, webhook_secret, sensitive_data
Microsoft.Security/regulatoryComplianceStandards/controls/assessments properties - leaks sensitive_data, customer_data
Microsoft.Security/securityContacts properties.{emails,phone,notificationsByRole} - leaks pii, sensitive_data
Azure Pipelines build artifact file content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure Pipelines build/release log content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure Pipelines build tags[] - leaks credential, api_key, sensitive_data, pii
Azure Repos pipeline YAML and inline script/task inputs - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Azure Pipelines job environment/task input generated from variable marked isSecret=true - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Azure DevOps variable group.variables.<name>.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Compute/disks.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Compute/snapshots.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/dnsZones recordSet properties for CAA/TXT/MX/CNAME - leaks sensitive_data
Microsoft.Network/privateDnsZones recordSets properties - leaks sensitive_data
Microsoft.Network/dnsZones/TXT.recordSets.properties.TXTRecords[].value[] - leaks credential, api_key, oauth_token, sensitive_data
Microsoft.Network/{dnsZones,privateDnsZones}.tags.* and recordSet.metadata.* - leaks credential, api_key, sensitive_data, pii
microsoft.graph.application.keyCredentials[].key - leaks certificate, sensitive_data
microsoft.graph.application.passwordCredentials[] - leaks credential
microsoft.graph.application.tags[] - leaks credential, api_key, sensitive_data, pii
microsoft.graph.application.federatedIdentityCredentials[].{issuer,subject,audiences,description} - leaks sensitive_data
microsoft.graph.user.{businessPhones,mobilePhone,mail,otherMails,onPremisesExtensionAttributes} - leaks pii, sensitive_data
Event Grid delivery-failure logs and dead-letter blob content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.EventGrid/domains.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.EventGrid/eventSubscriptions.properties.{destination,deadLetterDestination,filter,labels} - leaks credential, api_key, webhook_secret, sensitive_data
Microsoft.EventGrid/topics.tags.* - leaks credential, api_key, sensitive_data, pii
Event Hubs diagnostic and operational log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.EventHub/namespaces.tags.* - leaks credential, api_key, sensitive_data, pii
Azure Firewall application, network, DNS, threat-intelligence, and IDPS log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Network/azureFirewalls.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/azureFirewalls.properties.{applicationRuleCollections,networkRuleCollections,natRuleCollections} - leaks sensitive_data
Microsoft.Network/azureFirewalls.properties.additionalProperties and firewallPolicy.transportSecurity.certificateAuthority.keyVaultSecretId - leaks sensitive_data, certificate
Front Door access, health probe, and WAF log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data