Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
firestore.projects.databases.userCreds.create/firestore.projects.databases.userCreds.resetPassword.securePassword - leaks password, database_credential, credential
logging.entries.list.entries[].{textPayload,jsonPayload,protoPayload,labels} - leaks credential, customer_data, pii, sensitive_data
compute.firewalls.get.description - leaks credential, api_key, sensitive_data, pii
compute.firewallPolicies.getRule.{targetResources[],targetServiceAccounts[]} - leaks pii, sensitive_data
compute.instances.get.metadata.items[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, source_code_secret
compute.instanceTemplates.get.properties.metadata.items[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, source_code_secret
compute.projects.get.commonInstanceMetadata.items[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, source_code_secret
compute.instances.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
compute.instances.getSerialPortOutput.contents - leaks credential, password, api_key, oauth_token, private_key, connection_string, sensitive_data
cloudfunctions.projects.locations.functions.get.buildConfig.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
cloudfunctions.projects.locations.functions.get.description - leaks credential, api_key, sensitive_data, pii
cloudfunctions.projects.locations.functions.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
cloudfunctions.projects.locations.functions.get.serviceConfig.environmentVariables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
cloudfunctions.projects.locations.functions.get.buildConfig.source.storageSource -> Cloud Storage object bytes - leaks source_code_secret, credential, password, api_key, private_key
storage.objects.get.HTTP response body under artifacts.<project>.appspot.com - leaks source_code_secret, credential, private_key, customer_data
storage.objects.get.metadata.<value> - leaks credential, api_key, sensitive_data, pii
storage.buckets.getIamPolicy.bindings[].{members[],condition} - leaks pii, sensitive_data
storage.buckets.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
storage.projects.hmacKeys.create.secret - leaks secret_key, credential
storage.objects.watchAll.request.token - leaks webhook_secret, credential
storage.objects.get.HTTP response body (alt=media) - leaks credential, private_key, source_code_secret, customer_data, pii
storage.objects.get.metadata.<value> - leaks credential, api_key, sensitive_data, pii
container.projects.zones.clusters.get.resourceLabels.<value> - leaks credential, api_key, sensitive_data, pii
Kubernetes CoreV1 readNamespacedConfigMap/listConfigMapForAllNamespaces.ConfigMap.{data,binaryData}.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, source_code_secret
Kubernetes CoreV1 readNamespacedSecret/listSecretForAllNamespaces.Secret.data.<value>/Secret.stringData.<value> - leaks credential, password, api_key, private_key, certificate, sensitive_data
container.projects.zones.clusters.get.masterAuth.{username,password,clientCertificate,clientKey} - leaks credential, password, private_key, certificate
Kubernetes workload GET/LIST.PodSpec.containers[].{command[],args[]} - leaks credential, password, api_key, access_key, secret_key, oauth_token, sensitive_data
Kubernetes workload GET/LIST.PodSpec.containers[].env[].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
iam.projects.roles.get.{title,description} - leaks credential, api_key, sensitive_data, pii
iam.policies.get.rules[].denialCondition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
iam.policies.get.rules[].denyRule.{deniedPrincipals[],exceptionPrincipals[]} - leaks pii, sensitive_data
cloudresourcemanager.projects.getIamPolicy.bindings[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.getIamPolicy.bindings[].members[] - leaks pii, sensitive_data
iap.updateIapSettings.request.accessSettings.{oauthSettings.clientSecret,workforceIdentitySettings.oauth2.clientSecret} - leaks oauth_token, secret_key, credential
iap.projects.brands.identityAwareProxyClients.get.secret - leaks oauth_token, secret_key, credential
iap.getIamPolicy.bindings[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
iap.getIamPolicy.bindings[].members[] - leaks pii, sensitive_data
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.asymmetricSign.signature - leaks signing_secret, credential
cloudkms.projects.locations.keyRings.cryptoKeys.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.decapsulate.sharedSecret - leaks encryption_key_material, credential
cloudkms.projects.locations.keyRings.cryptoKeys.decrypt.plaintext - leaks credential, encryption_key_material, sensitive_data
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.macSign.mac - leaks signing_secret, credential
cloudkms.projects.locations.keyRings.cryptoKeys.cryptoKeyVersions.rawDecrypt.plaintext - leaks credential, encryption_key_material, sensitive_data
compute.backendServices.get.{customRequestHeaders[],customResponseHeaders[]} - leaks credential, api_key, oauth_token, sensitive_data
compute.backendServices.insert/compute.backendServices.patch/compute.backendServices.update.request.iap.oauth2ClientSecret - leaks oauth_token, secret_key, credential
compute.sslCertificates.get.certificate - leaks certificate, sensitive_data
compute.sslCertificates.insert/compute.regionSslCertificates.insert.request.{privateKey,selfManaged.privateKey} - leaks private_key, credential
compute.urlMaps.get.headerAction.{requestHeadersToAdd[],responseHeadersToAdd[]}.headerValue - leaks credential, api_key, oauth_token, sensitive_data
logging.entries.list.entries[].{labels.<value>,resource.labels.<value>,httpRequest} - leaks credential, pii, sensitive_data
logging.entries.list.entries[].{textPayload,jsonPayload,protoPayload} - leaks credential, password, api_key, oauth_token, customer_data, pii, sensitive_data