Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
ExportCertificate.PrivateKey - leaks private_key, certificate, credential
GetWebhook.webhook.webhookUrl - leaks webhook_secret, credential
GetApiKey.value (includeValue=true) - leaks api_key, credential
DescribeStacks.Stacks[].Outputs[].OutputValue - leaks credential, password, api_key, connection_string, sensitive_data
CloudHSM client PKCS#11/JCE/OpenSSL key object with EXTRACTABLE=true - leaks private_key, encryption_key_material, signing_secret, credential
GetAuthorizationToken.authorizationToken - leaks bearer_token, credential
BatchGetBuilds.builds[].exportedEnvironmentVariables[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
CreateWebhook.webhook.secret - leaks webhook_secret, credential
ListActionExecutions.actionExecutionDetails[].output.outputVariables.<value> - leaks credential, password, api_key, connection_string, sensitive_data
DescribeUserPoolClient.UserPoolClient.ClientSecret - leaks secret_key, oauth_token, credential
PollForTask.taskObject.objects.<object-id>.fields[].stringValue - leaks credential, password, api_key, access_key, secret_key, connection_string, database_credential
DescribeRouterConfiguration.customerRouterConfig - leaks password, signing_secret, credential, sensitive_data
DescribeVirtualInterfaces.virtualInterfaces[].authKey - leaks password, signing_secret, credential
CreateKeyPair.KeyMaterial - leaks private_key, credential
GetPasswordData.PasswordData - leaks password, credential
GetConnection.Connection.ConnectionProperties.{USERNAME,PASSWORD,JDBC_CONNECTION_URL,CUSTOM_*} - leaks credential, password, connection_string, database_credential, api_key, oauth_token
CreateAccessKey.AccessKey.SecretAccessKey - leaks access_key, secret_key, credential
CreateServiceSpecificCredential.ServiceSpecificCredential.ServicePassword - leaks password, credential
GenerateDataKeyPair.PrivateKeyPlaintext - leaks private_key, encryption_key_material, credential
GenerateDataKey.Plaintext - leaks encryption_key_material, credential
Decrypt.Plaintext - leaks credential, password, api_key, private_key, sensitive_data
GenerateRandom.Plaintext - leaks encryption_key_material, signing_secret, credential
GetRelationalDatabaseMasterUserPassword.masterUserPassword - leaks password, database_credential, credential
GetSensitiveDataOccurrences.sensitiveDataOccurrences.<type>[].value - leaks credential, password, api_key, access_key, secret_key, private_key, pii, sensitive_data, customer_data
DescribeApps.Apps[].AppSource.Password / SshKey - leaks password, private_key, credential
DescribeApps.Apps[].SslConfiguration.PrivateKey - leaks private_key, certificate, credential
DescribeRdsDbInstances.RdsDbInstances[].DbPassword - leaks password, database_credential, credential
GenerateEmbedUrlForAnonymousUser.EmbedUrl - leaks bearer_token, session_token, credential
GenerateEmbedUrlForRegisteredUser.EmbedUrl - leaks bearer_token, session_token, credential
GetClusterCredentials.DbPassword - leaks password, database_credential, credential
CreateSession.CredentialSet[].Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
DescribeRecord.RecordOutputs[].OutputValue - leaks credential, password, api_key, connection_string, sensitive_data
GetPlatformApplicationAttributes.Attributes.PlatformCredential / PlatformPrincipal - leaks private_key, secret_key, oauth_token, credential
AssumeRole.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
GetFederationToken.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
AssumeRoleWithSAML.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
AssumeRoleWithWebIdentity.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
DescribeVpnConnections.VpnConnections[].CustomerGatewayConfiguration - leaks password, signing_secret, credential, sensitive_data
GetWebACL.WebACL.CustomResponseBodies.<key>.Content - leaks credential, api_key, sensitive_data, customer_data
Microsoft.ContainerRegistry/registries/listCredentials response.{username,passwords[].value} - leaks credential, password
Microsoft.ContainerRegistry/registries/generateCredentials response.{username,passwords[].value} - leaks credential, password, access_key
Microsoft.Storage/storageAccounts/listKeys response.keys[].value - leaks credential, access_key, secret_key
Blob service SAS/account SAS/user delegation SAS URI query - leaks credential, session_token, signing_secret
Microsoft.ContainerService/managedClusters/listClusterAdminCredential response.kubeconfigs[].value - leaks credential, certificate, private_key
Microsoft.ContainerService/managedClusters/listClusterUserCredential response.kubeconfigs[].value - leaks credential, certificate, private_key, oauth_token
Microsoft.AppConfiguration/configurationStores/listKeys response.value[].connectionString - leaks credential, access_key, secret_key, connection_string
Microsoft.Web/sites/publishxml publishingProfile.{userName,userPWD,destinationAppUrl,msdeploySite} - leaks credential, password
Microsoft.Web/sites/slots/publishxml publishingProfile.{userName,userPWD} - leaks credential, password
Microsoft.Automation/automationAccounts/webhooks create response.properties.uri - leaks credential, webhook_secret
Microsoft.Batch/batchAccounts/listKeys response.{primary,secondary} - leaks credential, access_key, secret_key