Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Network/applicationGateways.properties.sslCertificates[].properties.{data,password} - leaks credential, password, private_key, certificate
Microsoft.Network/applicationGateways.tags.* - leaks credential, api_key, sensitive_data, pii
Application Gateway access, firewall, and performance log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Network/loadBalancers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/loadBalancers/probes.properties.{requestPath,host} - leaks credential, api_key, sensitive_data
Microsoft.Network/applicationGateways.properties.rewriteRuleSets[].properties.rewriteRules[].actionSet.*.headerValue - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Log Analytics query response.tables[].rows[] - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.OperationalInsights/workspaces.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.OperationalInsights/workspaces/savedSearches.properties.{query,displayName,category,tags} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.SecurityInsights/automationRules properties.{triggeringLogic,actions,displayName} - leaks credential, webhook_secret, sensitive_data
Microsoft.SecurityInsights/incidents/comments properties.message - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.SecurityInsights/incidents properties.{title,description,additionalData,relatedAnalyticRuleIds,providerIncidentId} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.OperationalInsights/workspaces/sharedKeys response.{primarySharedKey,secondarySharedKey} - leaks credential, access_key, secret_key
Microsoft.Logic/workflows/listCallbackUrl or accessEndpoint response - leaks credential, webhook_secret, session_token
Microsoft.Web/connections/listConnectionKeys response.{connectionKey,parameterValues} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Web/connections.properties.parameterValues and customParameterValues - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, oauth_token
Microsoft.Logic/workflows/triggers/listCallbackUrl response.value and queries.sig - leaks credential, webhook_secret, session_token
Microsoft.Logic/workflows.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Logic/workflows/runs/actions properties.{inputsLink,outputsLink,error} referenced content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Logic/workflows/triggers/histories properties.{inputsLink,outputsLink,error} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Logic/workflows.properties.definition - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Logic/workflows.properties.parameters.*.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Azure ML code asset referenced storage content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, source_code_secret
Microsoft.MachineLearningServices/workspaces/computes/listKeys response - leaks credential, password, private_key, access_key
Microsoft.MachineLearningServices/workspaces/datastores/listSecrets response.{secrets,credentials} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.MachineLearningServices/workspaces/onlineEndpoints/deployments.properties.environmentVariables.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.MachineLearningServices/workspaces/jobs.properties.{command,environmentVariables,parameters,inputs,outputs} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Azure ML job services, logs, outputs, and artifacts - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure ML workspace file/notebook content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Microsoft.MachineLearningServices/workspaces/onlineEndpoints/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
Microsoft.MachineLearningServices/workspaces/onlineEndpoints/token response.accessToken - leaks credential, oauth_token, bearer_token
Microsoft.MachineLearningServices/workspaces.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.MachineLearningServices/workspaces/connections/listSecrets response.credentials - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, oauth_token
Microsoft.MachineLearningServices/workspaces/listKeys response.{userStorageKey,appInsightsInstrumentationKey,containerRegistryCredentials,notebookAccessKeys} - leaks credential, access_key, password, connection_string
Managed HSM Full Backup request.azureStorageBlobContainerUri - leaks credential, session_token, connection_string
Managed HSM Key backup response.value - leaks encryption_key_material, sensitive_data
Managed HSM Key decrypt response.result - leaks credential, sensitive_data
Managed HSM KeyBundle.{key.kid,key.key_ops,tags} - leaks sensitive_data, pii
Managed HSM Key sign response.value - leaks credential, signing_secret
Microsoft.KeyVault/managedHSMs.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials.properties.{issuer,subject,audiences} - leaks sensitive_data
Microsoft.ManagedIdentity/userAssignedIdentities.{properties,tags} - leaks sensitive_data
IMDS /metadata/identity/oauth2/token response.access_token - leaks credential, oauth_token, bearer_token
Microsoft.ManagedIdentity/userAssignedIdentities.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Management/managementGroups.properties.{displayName,details,parent,children} - leaks sensitive_data
Microsoft.Management/managementGroups/descendants[].{name,type,properties.displayName,parent} - leaks sensitive_data
Microsoft.Management/managementGroups.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Insights/actionGroups.properties.webhookReceivers[].{serviceUri,identifierUri,objectId,tenantId,useAadAuth} - leaks credential, webhook_secret, sensitive_data
Azure Monitor Activity Log event.{caller,claims,authorization,properties,httpRequest,resourceId,status} - leaks credential, oauth_token, sensitive_data, pii
Microsoft.Insights/diagnosticSettings.properties.{workspaceId,storageAccountId,eventHubAuthorizationRuleId,eventHubName,serviceBusRuleId} - leaks sensitive_data