Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
DescribeJobs.jobs[].parameters / container.environment[].value / ecsProperties.taskProperties[].containers[].environment[].value / eksProperties.podProperties.containers[].env[].value - leaks credential, password, api_key, connection_string
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[Namespace=aws:elasticbeanstalk:application:environment].Value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeApplicationVersions.ApplicationVersions[].SourceBundle -> S3 object body - leaks source_code_secret, credential, private_key, api_key, password
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeConfigurationSettings.ConfigurationSettings[].OptionSettings[].Value (TemplateName) - leaks credential, password, api_key, connection_string
bedrock-agent:GetAgentActionGroup.agentActionGroup.apiSchema.payload / functionSchema - leaks credential, api_key, connection_string, source_code_secret, sensitive_data
bedrock-agent:GetAgent.agent.instruction / promptOverrideConfiguration - leaks credential, password, api_key, customer_data, pii, source_code_secret
bedrock-agent:GetPrompt.variants[].templateConfiguration - leaks credential, password, api_key, customer_data, pii, source_code_secret
Configured S3/CloudWatch Bedrock model invocation log record - leaks credential, password, api_key, customer_data, pii, source_code_secret, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
bedrock-runtime InvokeModel/Converse request body and response body - leaks credential, password, api_key, customer_data, pii, source_code_secret, sensitive_data
DescribeStackEvents.StackEvents[].ResourceStatusReason - leaks credential, password, api_key, sensitive_data
DescribeStacks.Stacks[].Outputs[].OutputValue - leaks credential, password, api_key, connection_string, sensitive_data
DescribeStacks.Stacks[].Parameters[].ParameterValue - leaks credential, password, api_key, access_key, secret_key, connection_string, sensitive_data
DescribeStacks.Stacks[].Tags[].Value - leaks credential, sensitive_data
GetTemplate.TemplateBody (Parameters.Default, Metadata, Mappings, Resources properties, Outputs) - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret
S3 CloudFront standard or real-time log record - leaks credential, api_key, bearer_token, session_token, pii, sensitive_data
GetFunction.FunctionCode - leaks source_code_secret, credential, password, api_key
cloudfront-keyvaluestore:GetKey.Value - leaks credential, password, api_key, bearer_token, sensitive_data
GetDistributionConfig.DistributionConfig.Origins.Items[].CustomHeaders.Items[].HeaderValue - leaks credential, api_key, bearer_token, password
ListTagsForResource.Tags.Items[].Value - leaks credential, sensitive_data
ListTags.TagList[].Value - leaks credential, sensitive_data
CloudHSM client PKCS#11/JCE/OpenSSL key object with EXTRACTABLE=true - leaks private_key, encryption_key_material, signing_secret, credential
CloudHSM CLI user create/change-password password input - leaks password, credential
GetQueryResults.QueryResultRows[].<field> - leaks credential, password, api_key, session_token, pii, sensitive_data
LookupEvents.Events[].CloudTrailEvent (requestParameters / responseElements / additionalEventData) - leaks credential, password, api_key, bearer_token, session_token, pii, sensitive_data
StartQuery request.QueryStatement - leaks credential, password, api_key, sensitive_data
ListTags.ResourceTagList[].TagsList[].Value - leaks credential, sensitive_data
DescribeAlarms.MetricAlarms[].AlarmDescription / CompositeAlarms[].AlarmDescription - leaks credential, sensitive_data, pii
GetDashboard.DashboardBody - leaks credential, api_key, bearer_token, connection_string, sensitive_data
logs:FilterLogEvents.events[].message - leaks credential, password, api_key, access_key, secret_key, oauth_token, bearer_token, private_key, connection_string, customer_data, pii
logs:ListTagsForResource.tags.<value> - leaks credential, sensitive_data
logs:GetQueryResults.results[][].{field,value} - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
logs:DescribeQueries.queries[].queryString - leaks credential, password, api_key, sensitive_data
ListMetrics.Metrics[].Dimensions[].Value - leaks credential, sensitive_data, pii
GetAuthorizationToken.authorizationToken - leaks bearer_token, credential
GetPackageVersionAsset.asset - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key, connection_string
ListTagsForResource.tags[].value - leaks credential, sensitive_data
CloudWatch Logs/S3 CodeBuild log content - leaks credential, password, api_key, access_key, secret_key, private_key, source_code_secret
BatchGetBuilds.builds[].environment.environmentVariables[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
BatchGetBuilds.builds[].exportedEnvironmentVariables[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
BatchGetProjects.projects[].source.buildspec / projects[].secondarySources[].buildspec - leaks source_code_secret, credential, password, api_key, connection_string
BatchGetProjects.projects[].environment.environmentVariables[type=PLAINTEXT].value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
ListProjects + BatchGetProjects.projects[].tags[].value - leaks credential, sensitive_data
CreateWebhook.webhook.secret - leaks webhook_secret, credential
GetCommit.commit.message - leaks credential, password, api_key, sensitive_data
GetCommentsForPullRequest.commentsForPullRequestData[].comments[].content - leaks credential, password, api_key, sensitive_data, pii
GetFile.fileContent - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key, connection_string
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
Target host or Lambda deployment CloudWatch Logs event.message - leaks credential, password, api_key, access_key, secret_key, source_code_secret