Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
Purview lineage entities and process attributes - leaks sensitive_data, pii, customer_data
Microsoft.Purview/accounts.tags.* - leaks credential, api_key, sensitive_data, pii
Purview Scan properties.credential reference and collection - leaks credential, sensitive_data
Purview scanning DataSource.{properties,collection,lastModifiedBy} - leaks credential, connection_string, sensitive_data
Purview ScanResult.{error,message,runType,startTime,endTime} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Authorization/roleDefinitions.properties.{roleName,description,permissions,assignableScopes} - leaks sensitive_data
Microsoft.Authorization/denyAssignments.properties.{principals,excludePrincipals,permissions,condition,description} - leaks sensitive_data
Microsoft.Authorization/roleAssignments.properties.{principalId,condition,conditionVersion,description} - leaks sensitive_data
Microsoft.Cache/redis/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
RESP GET/MGET/HGETALL/SCAN result values - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Cache/redis.properties.redisConfiguration.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
Microsoft.Cache/redisEnterprise/databases/listKeys response.{primaryKey,secondaryKey} - leaks credential, access_key, secret_key
Microsoft.Cache/redis.tags.* - leaks credential, api_key, sensitive_data, pii
Service Bus dead-letter subqueue Message.{body,applicationProperties,deadLetterReason,deadLetterErrorDescription} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
AMQP/Service Bus Message.{body,applicationProperties,subject,correlationId,sessionId} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.ServiceBus/namespaces/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.ServiceBus/namespaces/queues/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.ServiceBus/namespaces.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.ServiceBus/namespaces/topics/authorizationRules/listKeys response.{primaryKey,secondaryKey,primaryConnectionString,secondaryConnectionString} - leaks credential, access_key, secret_key, connection_string
Microsoft.ServiceFabric/clusters/applications.properties.parameters.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.ServiceFabric/clusters.properties.{certificate,certificateCommonNames,clientCertificateThumbprints,clientCertificateCommonNames} - leaks certificate, sensitive_data
Service Fabric events and health information descriptions - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.ServiceFabric/clusters.tags.* - leaks credential, api_key, sensitive_data, pii
Service Fabric service/application manifest configuration and environment overrides - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
Microsoft.Sql/servers.properties.administratorLoginPassword - leaks credential, password, database_credential
SQL audit records and AzureDiagnostics properties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
TDS sys.sql_modules.definition and job/agent command text - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, source_code_secret
TDS SELECT result-set cells - leaks database_credential, sensitive_data, pii, customer_data, credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Microsoft.Sql/managedInstances.properties.administratorLoginPassword - leaks credential, password, database_credential
Microsoft.Sql/servers.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Sql servers/databases/vulnerabilityAssessments scans results - leaks sensitive_data
Microsoft.Web/staticSites/config/appsettings properties.* - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
Static Web Apps build and deployment log content - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
staticwebapp.config.json routes, navigationFallback, auth and responseOverrides - leaks credential, api_key, sensitive_data
Microsoft.Web/staticSites/listSecrets response.properties.apiKey - leaks credential, api_key
Microsoft.Web/staticSites.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Storage/storageAccounts/listKeys response.keys[].value - leaks credential, access_key, secret_key
Microsoft.Storage/storageAccounts/listAccountSas response.accountSasToken - leaks credential, session_token
Blob.{content,metadata,tags} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Azure File.{content,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Queue Message.{MessageText,metadata} - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
Microsoft.Storage/storageAccounts.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Storage/storageAccounts/listServiceSas response.serviceSasToken - leaks credential, session_token
Table Entity user-defined properties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data, pii, customer_data
BlobService getUserDelegationKey response.{SignedOid,SignedTid,SignedStart,SignedExpiry,SignedService,SignedVersion,Value} - leaks credential, signing_secret
Microsoft.Resources/subscriptions/resourceGroups.tags.* - leaks credential, api_key, sensitive_data, pii
ARM generic resource.tags.* - leaks credential, api_key, sensitive_data, pii
Microsoft.Resources/subscriptions.{displayName,subscriptionPolicies,tenantId,tags} - leaks sensitive_data
Microsoft.Synapse/workspaces/integrationRuntimes/listAuthKeys response.{authKey1,authKey2} - leaks credential, access_key, secret_key
Synapse linkedService.properties.typeProperties - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string