Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Resources/deployments/operations.properties.statusMessage and properties.targetResource - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Resources/deployments.properties.outputs.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Resources/deployments.properties.parameters.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key
Microsoft.Resources/deploymentScripts.properties.{scriptContent,arguments,environmentVariables[].value,primaryScriptUri,supportingScriptUris} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Resources/deploymentScripts properties.outputs and logs - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Resources/deploymentScripts.properties.environmentVariables[].secureValue - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Resources/deployments.properties.template - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Resources/templateSpecs/versions.properties.{mainTemplate,linkedTemplates} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Automation certificate asset content - leaks credential, private_key, certificate, password
Microsoft.Automation/automationAccounts/connections.properties.fieldDefinitionValues.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Automation/automationAccounts/credentials get response.properties.{userName,password} - leaks credential, password
Microsoft.Automation/automationAccounts/jobs/{job}/streams properties.streamText and job output - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Automation/automationAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Automation/automationAccounts/runbooks/content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Automation/automationAccounts/variables.properties.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Automation/automationAccounts/webhooks create response.properties.uri - leaks credential, webhook_secret
microsoft.graph.identityProviderBase.clientSecret - leaks credential, password, signing_secret
microsoft.graph.identityProviderBase.{clientId,displayName,developerId,metadataUrl} - leaks sensitive_data
microsoft.graph.user.passwordProfile.password - leaks credential, password
microsoft.graph.trustFrameworkKeySet uploadSecret request.{use,k} - leaks credential, signing_secret, encryption_key_material
TrustFrameworkPolicy XML - leaks credential, api_key, sensitive_data, pii
microsoft.graph.user.extensions and extension_* properties - leaks pii, customer_data, sensitive_data
Microsoft.Batch/batchAccounts/listKeys response.{primary,secondary} - leaks credential, access_key, secret_key
Batch NodeFile content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Batch Pool.startTask.{commandLine,environmentSettings,resourceFiles} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Batch Pool/Job/Task.metadata[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Batch/batchAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Batch Task.{commandLine,environmentSettings,resourceFiles,outputFiles} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Blueprint/blueprints.properties.parameters.*.defaultValue - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Blueprint/blueprints/artifacts.properties.template and parameters - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Resources/deploymentStacks.properties.outputs.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Resources/deploymentStacks.properties.parameters.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Search/searchServices/listAdminKeys response.{primaryKey,secondaryKey} - leaks credential, api_key, access_key
Search DataSource.credentials.connectionString - leaks credential, password, connection_string, database_credential
Azure AI Search index document fields - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Search Indexer execution history.{statusDetail,errorMessage,warnings} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Search/searchServices/listQueryKeys response.value[].key - leaks credential, api_key, access_key
Microsoft.Search/searchServices.tags.* - leaks credential, api_key, sensitive_data, pii
Search Skillset.skills[] and Indexer.{parameters,fieldMappings,outputFieldMappings} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data
SearchIndexerSkillset.cognitiveServices.key and WebApiSkill.httpHeaders.<value> - leaks credential, api_key
Microsoft.App/containerApps/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Container Apps log stream messages - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.App/containerApps.properties.template.containers[].{command,args} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps.properties.template.containers[].env[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/managedEnvironments/daprComponents/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps.properties.configuration.dapr and Dapr component metadata - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/jobs/listSecrets response.value[].{name,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.App/containerApps/listSecrets registry secret values referenced by properties.configuration.registries[].passwordSecretRef - leaks credential, password
Microsoft.App/containerApps.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DocumentDB/databaseAccounts/listKeys -> primaryMasterKey - leaks credential, access_key