Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Storage/storageAccounts/listAccountSas response.accountSasToken - leaks credential, session_token
Microsoft.Storage/storageAccounts/listServiceSas response.serviceSasToken - leaks credential, session_token
BlobService getUserDelegationKey response.{SignedOid,SignedTid,SignedStart,SignedExpiry,SignedService,SignedVersion,Value} - leaks credential, signing_secret
Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys response.{authKey1,authKey2} - leaks credential, access_key, secret_key
Microsoft.Network/expressRouteCircuits/authorizations.properties.authorizationKey - leaks credential, access_key
Microsoft.Network/connections/sharedkey response.value - leaks credential, password, signing_secret
Microsoft.Network/vpnGateways/vpnConnections/sharedkey response.value - leaks credential, password, signing_secret
sql.sslCerts.insert.clientCert.certPrivateKey - leaks private_key, database_credential, credential
firestore.projects.databases.userCreds.create/firestore.projects.databases.userCreds.resetPassword.securePassword - leaks password, database_credential, credential
storage.projects.hmacKeys.create.secret - leaks secret_key, credential
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign.signature - leaks signing_secret, credential
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.decapsulate.sharedSecret - leaks encryption_key_material, credential
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.macSign.mac - leaks signing_secret, credential
iamcredentials.projects.serviceAccounts.generateAccessToken.accessToken - leaks oauth_token, bearer_token, credential
iamcredentials.projects.serviceAccounts.generateIdToken.token - leaks oauth_token, bearer_token, credential
iam.projects.serviceAccounts.keys.create.privateKeyData - leaks private_key, credential
iamcredentials.projects.serviceAccounts.signBlob.signedBlob - leaks credential, signing_secret
iamcredentials.projects.serviceAccounts.signJwt.signedJwt - leaks credential, signing_secret
aiplatform.projects.locations.featureOnlineStores.featureViews.generateFetchAccessToken.accessToken - leaks access_key, bearer_token, credential
notebooks.projects.locations.instances.generateAccessToken.access_token - leaks oauth_token, bearer_token, credential
iam.projects.locations.oauthClients.credentials.create.clientSecret - leaks oauth_token, secret_key, credential
iam.locations.workforcePools.providers.scimTenants.tokens.create.securityToken - leaks bearer_token, credential