Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Search/searchServices/listAdminKeys response.{primaryKey,secondaryKey} - leaks credential, api_key, access_key
Microsoft.Search/searchServices/listQueryKeys response.value[].key - leaks credential, api_key, access_key
Microsoft.App/containerApps/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Microsoft.App/managedEnvironments/daprComponents/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/jobs/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps/listSecrets registry secret values referenced by properties.configuration.registries[].passwordSecretRef - leaks credential, password
Microsoft.DocumentDB/databaseAccounts/listKeys response.{primaryMasterKey,secondaryMasterKey} - leaks credential, access_key, secret_key
Microsoft.DocumentDB/databaseAccounts/listConnectionStrings response.connectionStrings[].connectionString - leaks credential, connection_string, database_credential
Microsoft.DocumentDB/databaseAccounts/readonlykeys response.{primaryReadonlyMasterKey,secondaryReadonlyMasterKey} - leaks credential, access_key, secret_key
Databricks service principal secret create response.secret - leaks credential, password, oauth_token
Databricks token/create response.token_value - leaks credential, access_key, bearer_token
Microsoft.DataFactory/factories/integrationRuntimes/listAuthKeys response.{authKey1,authKey2} - leaks credential, access_key, secret_key
Microsoft.DataFactory/factories/linkedservices/listAuthKeys response - leaks credential, access_key, secret_key
Azure DevOps PAT create response.patToken.token - leaks credential, access_key, bearer_token
Microsoft.Compute/disks/beginGetAccess response.accessSAS - leaks credential, session_token
Microsoft.Compute/snapshots/beginGetAccess response.accessSAS - leaks credential, session_token
microsoft.graph.passwordCredential.secretText - leaks credential, password
microsoft.graph.passwordCredential.secretText - leaks credential, password
Microsoft.EventGrid/domains/listKeys response.{key1,key2} - leaks credential, access_key, secret_key
Microsoft.EventGrid/topics/listKeys response.{key1,key2} - leaks credential, access_key, secret_key
Microsoft.EventHub/namespaces/eventhubs/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.EventHub/namespaces/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.Web/sites/functions/listkeys response.{default,keyNames} - leaks credential, api_key
Microsoft.Web/sites/host/listkeys response.{masterKey,functionKeys,systemKeys} - leaks credential, api_key
Microsoft.Web/sites/publishxml publishingProfile.{userName,userPWD,destinationAppUrl,msdeploySite} - leaks credential, password
Microsoft.Web/sites/slots/host/listkeys response.{masterKey,functionKeys,systemKeys} - leaks credential, api_key
Microsoft.Web/sites/slots/publishxml publishingProfile.{userName,userPWD} - leaks credential, password
Key Vault Key sign response.value - leaks credential, signing_secret
Microsoft.OperationalInsights/workspaces/sharedKeys response.{primarySharedKey,secondarySharedKey} - leaks credential, access_key, secret_key
Microsoft.Logic/workflows/listCallbackUrl or accessEndpoint response - leaks credential, webhook_secret, session_token
Microsoft.Web/connections/listConnectionKeys response.{connectionKey,parameterValues} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Logic/workflows/triggers/listCallbackUrl response.value and queries.sig - leaks credential, webhook_secret, session_token
Microsoft.MachineLearningServices/workspaces/computes/listKeys response - leaks credential, password, private_key, access_key
Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
Microsoft.MachineLearningServices/workspaces/onlineEndpoints/token response.accessToken - leaks credential, oauth_token, bearer_token
Microsoft.MachineLearningServices/workspaces/listKeys response.{userStorageKey,appInsightsInstrumentationKey,containerRegistryCredentials,notebookAccessKeys} - leaks credential, access_key, password, connection_string
Managed HSM Key sign response.value - leaks credential, signing_secret
IMDS /metadata/identity/oauth2/token response.access_token - leaks credential, oauth_token, bearer_token
OAuth 2.0 token response.{access_token,refresh_token,id_token} - leaks credential, oauth_token, bearer_token, session_token
Microsoft.NetApp/netAppAccounts/listCredentials response.{username,password} - leaks credential, password
Microsoft.NotificationHubs/namespaces/notificationHubs/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.CognitiveServices/accounts/listKeys response.{key1,key2} - leaks credential, api_key, access_key
Microsoft.Purview/accounts/listKeys response.{atlasKafkaPrimaryEndpoint,atlasKafkaSecondaryEndpoint} - leaks credential, access_key, secret_key, connection_string
Microsoft.Cache/redis/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
Microsoft.Cache/redisEnterprise/databases/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
Microsoft.ServiceBus/namespaces/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.ServiceBus/namespaces/queues/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.Web/staticSites/listSecrets response.properties.apiKey - leaks credential, api_key
Microsoft.Storage/storageAccounts/listKeys response.keys[].value - leaks credential, access_key, secret_key