Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.DocumentDB/databaseAccounts/listKeys response.{primaryMasterKey,secondaryMasterKey} - leaks credential, access_key, secret_key
Microsoft.DocumentDB/databaseAccounts/listConnectionStrings response.connectionStrings[].connectionString - leaks credential, connection_string, database_credential
Cosmos DB SQL container items - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Cosmos DB MongoDB documents, Cassandra rows, Gremlin vertices/edges, or Table entities - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.DocumentDB/databaseAccounts/readonlykeys response.{primaryReadonlyMasterKey,secondaryReadonlyMasterKey} - leaks credential, access_key, secret_key
Microsoft.DocumentDB/databaseAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Cosmos DB scripts storedProcedures[].body, triggers[].body, userDefinedFunctions[].body - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks cluster.{spark_conf,spark_env_vars,custom_tags,init_scripts} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks global init script response.script - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks jobs runs get-output response.{notebook_output.result,logs,error,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Databricks job.settings.tasks[].{notebook_task,spark_python_task,spark_jar_task,spark_submit_task,sql_task,run_job_task} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Databricks Workspace export content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Databricks service principal secret create response.secret - leaks credential, password, oauth_token
Databricks token/create response.token_value - leaks credential, access_key, bearer_token
Microsoft.Databricks/workspaces.tags.* - leaks credential, api_key, sensitive_data, pii
Databricks Secrets put request.{string_value,bytes_value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Databricks SQL Statement Execution result.data_array - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Data Factory activity run.{input,output,error} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.DataFactory/factories/globalParameters.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.DataFactory/factories/integrationRuntimes/listAuthKeys response.{authKey1,authKey2} - leaks credential, access_key, secret_key
Microsoft.DataFactory/factories/linkedservices/listAuthKeys response - leaks credential, access_key, secret_key
Microsoft.DataFactory/factories/linkedservices.properties.typeProperties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key
Microsoft.DataFactory/factories/pipelines.properties.{parameters,variables,activities} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.DataFactory/factories.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DataFactory/factories/triggers.properties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Security/assessments properties.{displayName,status,resourceDetails,additionalData,links} - leaks sensitive_data, pii, customer_data
Microsoft.Security/automations properties.{sources,actions,scopes,description} - leaks credential, webhook_secret, sensitive_data
Microsoft.Security/regulatoryComplianceStandards/controls/assessments properties - leaks sensitive_data, customer_data
Microsoft.Security/locations/alerts properties.{description,remediationSteps,entities,extendedProperties,resourceIdentifiers} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Security/securityContacts properties.{emails,phone,notificationsByRole} - leaks pii, sensitive_data
Azure Pipelines build artifact file content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure Pipelines build/release log content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure Pipelines build tags[] - leaks credential, api_key, sensitive_data, pii
Azure DevOps PAT create response.patToken.token - leaks credential, access_key, bearer_token
Azure Repos pipeline YAML and inline script/task inputs - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Azure Pipelines job environment/task input generated from variable marked isSecret=true - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Azure Pipelines secure file bytes - leaks credential, private_key, certificate, sensitive_data
Azure DevOps service endpoint.authorization.parameters.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key
Azure DevOps variable group.variables.<name>.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Compute/disks/beginGetAccess response.accessSAS - leaks credential, session_token
Microsoft.Compute/disks.tags.* - leaks credential, api_key, sensitive_data, pii
Guest-mounted managed disk filesystem blocks/files - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, source_code_secret, sensitive_data, pii, customer_data
Microsoft.Compute/snapshots/beginGetAccess response.accessSAS - leaks credential, session_token
Microsoft.Compute/snapshots.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/dnsZones recordSet properties for CAA/TXT/MX/CNAME - leaks sensitive_data
Microsoft.Network/privateDnsZones recordSets properties - leaks sensitive_data
Microsoft.Network/dnsZones/TXT.recordSets.properties.TXTRecords[].value[] - leaks credential, api_key, oauth_token, sensitive_data
Microsoft.Network/{dnsZones,privateDnsZones}.tags.* and recordSet.metadata.* - leaks credential, api_key, sensitive_data, pii
microsoft.graph.passwordCredential.secretText - leaks credential, password
microsoft.graph.application.keyCredentials[].key - leaks certificate, sensitive_data