Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
microsoft.graph.application.passwordCredentials[] - leaks credential
microsoft.graph.application.tags[] - leaks credential, api_key, sensitive_data, pii
microsoft.graph.application.federatedIdentityCredentials[].{issuer,subject,audiences,description} - leaks sensitive_data
microsoft.graph.passwordCredential.secretText - leaks credential, password
microsoft.graph.user.{businessPhones,mobilePhone,mail,otherMails,onPremisesExtensionAttributes} - leaks pii, sensitive_data
Event Grid delivery-failure logs and dead-letter blob content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.EventGrid/domains/listKeys response.{key1,key2} - leaks credential, access_key, secret_key
Microsoft.EventGrid/domains.tags.* - leaks credential, api_key, sensitive_data, pii
CloudEvents/Event Grid event.{data,subject,topic,eventType} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.EventGrid/eventSubscriptions.properties.{destination,deadLetterDestination,filter,labels} - leaks credential, api_key, webhook_secret, sensitive_data
Microsoft.EventGrid/topics/listKeys response.{key1,key2} - leaks credential, access_key, secret_key
Microsoft.EventGrid/topics.tags.* - leaks credential, api_key, sensitive_data, pii
Event Hubs Capture Avro files in configured Storage destination - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Event Hubs diagnostic and operational log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
AMQP EventData.{body,properties,systemProperties} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.EventHub/namespaces/eventhubs/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.EventHub/namespaces/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.EventHub/namespaces.tags.* - leaks credential, api_key, sensitive_data, pii
Azure Firewall application, network, DNS, threat-intelligence, and IDPS log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Network/azureFirewalls.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/azureFirewalls.properties.{applicationRuleCollections,networkRuleCollections,natRuleCollections} - leaks sensitive_data
Microsoft.Network/azureFirewalls.properties.additionalProperties and firewallPolicy.transportSecurity.certificateAuthority.keyVaultSecretId - leaks sensitive_data, certificate
Front Door access, health probe, and WAF log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Cdn/profiles/originGroups/origins.properties.{hostName,originHostHeader,sharedPrivateLinkResource} - leaks sensitive_data
Microsoft.Cdn/profiles.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Cdn/profiles/ruleSets/rules.properties.actions[].parameters.{headerName,value} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Cdn/profiles/secrets.properties.parameters.{certificate,keyVaultCertificateSourceParameters} - leaks credential, private_key, certificate
Microsoft.Web/sites/config/appsettings.properties.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Web/sites/config/connectionstrings.properties.*.{value,type} - leaks credential, password, connection_string, database_credential
Microsoft.Web/sites log stream and diagnostic log content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Web/sites/functions/listkeys response.{default,keyNames} - leaks credential, api_key
Microsoft.Web/sites/functions.properties.{config,files,script_href,test_data_href} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data
Microsoft.Web/sites/host/listkeys response.{masterKey,functionKeys,systemKeys} - leaks credential, api_key
Microsoft.Web/sites/publishxml publishingProfile.{userName,userPWD,destinationAppUrl,msdeploySite} - leaks credential, password
Microsoft.Web/sites.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Web/sites.properties.siteConfig.{appCommandLine,linuxFxVersion,windowsFxVersion,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Web/sites/slots/config/appsettings.properties.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Web/sites/slots/host/listkeys response.{masterKey,functionKeys,systemKeys} - leaks credential, api_key
Microsoft.Web/sites/slots/publishxml publishingProfile.{userName,userPWD} - leaks credential, password
Key Vault certificate backing Secret.value - leaks credential, private_key, certificate, password
Key Vault CertificatePolicy.{issuerParameters,subject,subjectAlternativeNames,x509CertificateProperties} - leaks certificate, pii, sensitive_data
Key Vault Key decrypt response.result - leaks credential, sensitive_data
Key Vault Key sign response.value - leaks credential, signing_secret
Microsoft.KeyVault/vaults.tags.* - leaks credential, api_key, sensitive_data, pii
Key Vault Secret.{contentType,tags} - leaks credential, api_key, sensitive_data, pii
Key Vault Secret.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, signing_secret
{vaultUri}/secrets/{name} -> value - leaks credential, secret
Microsoft.ManagedServices/registrationAssignments.properties.{registrationDefinitionId,registrationDefinition,provisioningState} - leaks sensitive_data
Microsoft.ManagedServices/registrationDefinitions.properties.{authorizations,eligibleAuthorizations,managedByTenantId,description} - leaks sensitive_data
Microsoft.Network/applicationGateways.properties.authenticationCertificates[].properties.data - leaks certificate, sensitive_data