Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Insights/actionGroups.properties.webhookReceivers[].{serviceUri,identifierUri,objectId,tenantId,useAadAuth} - leaks credential, webhook_secret, sensitive_data
Microsoft.Insights/diagnosticSettings.properties.{workspaceId,storageAccountId,eventHubAuthorizationRuleId,eventHubName,serviceBusRuleId} - leaks sensitive_data
Microsoft.Insights/metricAlerts properties.actions[].webHookProperties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, webhook_secret
Microsoft.Insights/workbooks.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Insights/scheduledQueryRules.properties.{description,criteria,actions,scopes} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Insights/workbooks.properties.{serializedData,description,tags} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
microsoft.graph.appRoleAssignment.{principalId,resourceId,appRoleId} - leaks sensitive_data
microsoft.graph.subscription.clientState - leaks credential, webhook_secret
microsoft.graph.subscription.{notificationUrl,lifecycleNotificationUrl,notificationQueryOptions} - leaks credential, api_key, webhook_secret, sensitive_data
microsoft.graph.oAuth2PermissionGrant.{clientId,consentType,principalId,resourceId,scope} - leaks sensitive_data
microsoft.graph.servicePrincipal.appRoleAssignments[] - leaks sensitive_data
Microsoft.NetApp/netAppAccounts.properties.activeDirectories[].password - leaks credential, password
Microsoft.NetApp/netAppAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.NetApp/netAppAccounts/capacityPools/volumes.properties.{exportPolicy,dataProtection,protocolTypes,tags} - leaks sensitive_data, pii
Notification Hub send request body and platform headers - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.NotificationHubs/Namespaces/NotificationHubs.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/networkSecurityGroups.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/networkSecurityGroups/securityRules.properties.{description,sourceAddressPrefixes,destinationAddressPrefixes,sourceApplicationSecurityGroups,destinationApplicationSecurityGroups} - leaks sensitive_data, pii
Azure OpenAI assistant/thread/message/vector-store objects.{instructions,content,metadata,file_ids} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure OpenAI diagnostic logs and configured content logging destinations - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure OpenAI request.{messages,prompt,input,tools,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure OpenAI response.{choices,output,data,usage} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Microsoft.CognitiveServices/accounts.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Authorization/policyAssignments.properties.{description,metadata,parameters,nonComplianceMessages,overrides} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Authorization/policyDefinitions.properties.{displayName,description,metadata,parameters,policyRule} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.PolicyInsights/remediations/deployments deployment properties.outputs and operations.statusMessage - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Authorization/policySetDefinitions.properties.{description,metadata,parameters,policyDefinitions} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
PostgreSQL pg_proc.prosrc / MySQL routines and event bodies - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.DBforMySQL/flexibleServers.properties.administratorLoginPassword - leaks credential, password, database_credential
Microsoft.DBforMySQL/flexibleServers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DBforMySQL/flexibleServers/configurations.properties.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.DBforPostgreSQL/flexibleServers.properties.administratorLoginPassword - leaks credential, password, database_credential
Microsoft.DBforPostgreSQL/flexibleServers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DBforPostgreSQL/flexibleServers/configurations.properties.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Azure Monitor PostgreSQL/MySQL server log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Network/privateEndpoints/privateLinkServiceConnections.properties.requestMessage - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/privateEndpoints.properties.{subnet,customDnsConfigs,ipConfigurations,privateLinkServiceConnections} - leaks sensitive_data
Microsoft.Network/privateLinkServices.properties.{visibility,autoApproval,ipConfigurations,loadBalancerFrontendIpConfigurations} - leaks sensitive_data
Microsoft.Network/privateEndpoints.tags.* - leaks credential, api_key, sensitive_data, pii
Purview Atlas Classification.{typeName,attributes,entityGuid} - leaks pii, sensitive_data, customer_data
Purview lineage entities and process attributes - leaks sensitive_data, pii, customer_data
Microsoft.Purview/accounts.tags.* - leaks credential, api_key, sensitive_data, pii
Purview Scan properties.credential reference and collection - leaks credential, sensitive_data
Purview scanning DataSource.{properties,collection,lastModifiedBy} - leaks credential, connection_string, sensitive_data
Purview ScanResult.{error,message,runType,startTime,endTime} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Authorization/roleDefinitions.properties.{roleName,description,permissions,assignableScopes} - leaks sensitive_data
Microsoft.Authorization/denyAssignments.properties.{principals,excludePrincipals,permissions,condition,description} - leaks sensitive_data
Microsoft.Authorization/roleAssignments.properties.{principalId,condition,conditionVersion,description} - leaks sensitive_data
Microsoft.Cache/redis.properties.redisConfiguration.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Cache/redis.tags.* - leaks credential, api_key, sensitive_data, pii