Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Microsoft.Insights/metricAlerts properties.actions[].webHookProperties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, webhook_secret
Microsoft.Insights/workbooks.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Insights/scheduledQueryRules.properties.{description,criteria,actions,scopes} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Insights/workbooks.properties.{serializedData,description,tags} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
microsoft.graph.appRoleAssignment.{principalId,resourceId,appRoleId} - leaks sensitive_data
microsoft.graph.subscription.clientState - leaks credential, webhook_secret
microsoft.graph.subscription.{notificationUrl,lifecycleNotificationUrl,notificationQueryOptions} - leaks credential, api_key, webhook_secret, sensitive_data
microsoft.graph.oAuth2PermissionGrant.{clientId,consentType,principalId,resourceId,scope} - leaks sensitive_data
microsoft.graph.servicePrincipal.appRoleAssignments[] - leaks sensitive_data
OAuth 2.0 token response.{access_token,refresh_token,id_token} - leaks credential, oauth_token, bearer_token, session_token
Microsoft.NetApp/netAppAccounts/listCredentials response.{username,password} - leaks credential, password
Microsoft.NetApp/netAppAccounts.properties.activeDirectories[].password - leaks credential, password
Microsoft.NetApp/netAppAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.NetApp/netAppAccounts/capacityPools/volumes.properties.{exportPolicy,dataProtection,protocolTypes,tags} - leaks sensitive_data, pii
Mounted NFS/SMB volume file content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, source_code_secret, sensitive_data, pii, customer_data
Microsoft.NotificationHubs/namespaces/notificationHubs/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Notification Hub send request body and platform headers - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.NotificationHubs/namespaces/notificationHubs/pnsCredentials response.properties.{apnsCredential,gcmCredential,admCredential,baiduCredential,wnsCredential} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, private_key, certificate
Notification Hubs registration.{PnsHandle,Tags,SecondaryTile,TemplateBody} - leaks credential, sensitive_data, pii, customer_data
Microsoft.NotificationHubs/Namespaces/NotificationHubs.tags.* - leaks credential, api_key, sensitive_data, pii
Network Watcher NSG/virtual network flow-log records - leaks sensitive_data, pii, customer_data
Microsoft.Network/networkSecurityGroups.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/networkSecurityGroups/securityRules.properties.{description,sourceAddressPrefixes,destinationAddressPrefixes,sourceApplicationSecurityGroups,destinationApplicationSecurityGroups} - leaks sensitive_data, pii
Microsoft.CognitiveServices/accounts/listKeys response.{key1,key2} - leaks credential, api_key, access_key
Azure OpenAI assistant/thread/message/vector-store objects.{instructions,content,metadata,file_ids} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure OpenAI diagnostic logs and configured content logging destinations - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure OpenAI request.{messages,prompt,input,tools,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Azure OpenAI response.{choices,output,data,usage} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Microsoft.CognitiveServices/accounts.tags.* - leaks credential, api_key, sensitive_data, pii
Azure OpenAI File.{filename,purpose,content} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret, sensitive_data, pii, customer_data
Microsoft.Authorization/policyAssignments.properties.{description,metadata,parameters,nonComplianceMessages,overrides} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Authorization/policyDefinitions.properties.{displayName,description,metadata,parameters,policyRule} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.PolicyInsights/remediations/deployments deployment properties.outputs and operations.statusMessage - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Authorization/policySetDefinitions.properties.{description,metadata,parameters,policyDefinitions} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
PostgreSQL pg_proc.prosrc / MySQL routines and event bodies - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
PostgreSQL/MySQL protocol query result rows - leaks database_credential, sensitive_data, pii, customer_data, credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.DBforMySQL/flexibleServers.properties.administratorLoginPassword - leaks credential, password, database_credential
Microsoft.DBforMySQL/flexibleServers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DBforMySQL/flexibleServers/configurations.properties.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.DBforPostgreSQL/flexibleServers.properties.administratorLoginPassword - leaks credential, password, database_credential
Microsoft.DBforPostgreSQL/flexibleServers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.DBforPostgreSQL/flexibleServers/configurations.properties.value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Azure Monitor PostgreSQL/MySQL server log records - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Network/privateEndpoints/privateLinkServiceConnections.properties.requestMessage - leaks credential, api_key, sensitive_data, pii
Microsoft.Network/privateEndpoints.properties.{subnet,customDnsConfigs,ipConfigurations,privateLinkServiceConnections} - leaks sensitive_data
Microsoft.Network/privateLinkServices.properties.{visibility,autoApproval,ipConfigurations,loadBalancerFrontendIpConfigurations} - leaks sensitive_data
Microsoft.Network/privateEndpoints.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Purview/accounts/listKeys response.{atlasKafkaPrimaryEndpoint,atlasKafkaSecondaryEndpoint} - leaks credential, access_key, secret_key, connection_string
Purview Atlas Entity.{attributes,relationshipAttributes,labels,contacts,customAttributes} - leaks credential, sensitive_data, pii, customer_data
Purview Atlas Classification.{typeName,attributes,entityGuid} - leaks pii, sensitive_data, customer_data