Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
logging.projects.metrics.get.{filter,labelExtractors.<value>,description} - leaks credential, api_key, sensitive_data, pii
logging.projects.locations.savedQueries.get.loggingQuery.filter - leaks credential, pii, sensitive_data
logging.projects.sinks.get.{filter,destination} - leaks sensitive_data, pii
redis.projects.locations.aclPolicies.get.rules[].{username,rule} - leaks password, credential, pii, sensitive_data
redis.projects.locations.clusters.tokenAuthUsers.authTokens.get.token - leaks password, bearer_token, credential
redis.projects.locations.instances.get.{redisConfigs.<value>,labels.<value>,displayName} - leaks credential, api_key, sensitive_data, pii
redis.projects.locations.instances.getAuthString.authString - leaks password, credential
Redis GET/MGET/SCAN.key names and values - leaks credential, customer_data, pii, sensitive_data
monitoring.projects.alertPolicies.get.{documentation.content,conditions[],userLabels.<value>} - leaks credential, pii, sensitive_data
monitoring.projects.dashboards.get.{displayName,labels.<value>,mosaicLayout/gridLayout/rowLayout/columnLayout.widgets[]} - leaks credential, pii, sensitive_data
monitoring.projects.timeSeries.list.timeSeries[].{points[],metric.labels.<value>,resource.labels.<value>} - leaks customer_data, pii, sensitive_data
monitoring.projects.uptimeCheckConfigs.get.httpCheck.authInfo.{username,password} - leaks password, credential
monitoring.projects.uptimeCheckConfigs.get.httpCheck.{headers.<value>,path} - leaks credential, api_key, sensitive_data
networkconnectivity.projects.locations.global.hubs.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
networkconnectivity.projects.locations.serviceConnectionMaps.get.token - leaks bearer_token, credential
networkconnectivity.projects.locations.serviceConnectionTokens.get.token - leaks bearer_token, credential
networkconnectivity.projects.locations.spokes.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
networkconnectivity.projects.locations.spokes.get.{linkedVpnTunnels.uris[],linkedInterconnectAttachments.uris[],linkedRouterApplianceInstances.instances[]} - leaks sensitive_data
orgpolicy.projects.policies.get.spec.rules[].condition.{expression,title,description} - leaks credential, api_key, sensitive_data, pii
orgpolicy.projects.policies.get.spec.rules[].values.{allowedValues[],deniedValues[]} - leaks sensitive_data
compute.disks.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
Compute Engine disk attachment or snapshot export.mounted filesystem bytes - leaks credential, private_key, source_code_secret, customer_data, pii
compute.snapshots.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
compute.forwardingRules.get.{description,labels.<value>} - leaks credential, api_key, sensitive_data, pii
compute.serviceAttachments.get.{consumerAcceptLists[],consumerRejectLists[],domainNames[]} - leaks sensitive_data, pii
compute.serviceAttachments.get.{description,metadata.<value>} - leaks credential, api_key, sensitive_data, pii
pubsub.projects.subscriptions.pull.receivedMessages[].message.attributes.<value> - leaks credential, api_key, sensitive_data, pii
pubsub.projects.subscriptions.pull.receivedMessages[].message.data - leaks credential, customer_data, pii, sensitive_data
pubsub.projects.subscriptions.get.pushConfig.{pushEndpoint,attributes.<value>} - leaks credential, api_key, webhook_secret, sensitive_data
pubsub.projects.schemas.get.definition - leaks source_code_secret, credential, password, api_key, private_key
pubsub.projects.topics.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.folders.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.organizations.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.get.displayName - leaks credential, api_key, sensitive_data, pii
cloudresourcemanager.projects.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.securityHealthAnalyticsSettings.customModules.get.customConfig.{predicate,customOutput.properties,resourceSelector,description} - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.sources.findings.list.listFindingsResults[].finding.{description,eventTime,externalUri} - leaks pii, sensitive_data
securitycenter.organizations.sources.findings.list.listFindingsResults[].finding.{sourceProperties,securityMarks.marks,connections[],contacts,compliances[]} - leaks credential, customer_data, pii, sensitive_data
securitycenter.organizations.muteConfigs.get.{filter,description} - leaks credential, api_key, sensitive_data, pii
securitycenter.organizations.notificationConfigs.get.streamingConfig.filter - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.enableManagedRotation/secretmanager.projects.locations.secrets.enableManagedRotation.request.cloudSqlSingleUserCredentials.password - leaks password, database_credential, credential
secretmanager.projects.secrets.get.annotations.<value> - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.get.labels.<value> - leaks credential, api_key, sensitive_data, pii
secretmanager.projects.secrets.addVersion.request.payload.data - leaks credential, password, api_key, private_key, sensitive_data
secretmanager.projects.secrets.versions.access.payload.data - leaks credential, password, api_key, private_key, sensitive_data
iamcredentials.projects.serviceAccounts.generateAccessToken.accessToken - leaks oauth_token, bearer_token, credential
iamcredentials.projects.serviceAccounts.generateIdToken.token - leaks oauth_token, bearer_token, credential
iam.projects.serviceAccounts.keys.create.privateKeyData - leaks private_key, credential
iam.projects.serviceAccounts.get.{displayName,description} - leaks credential, api_key, sensitive_data, pii
iamcredentials.projects.serviceAccounts.signBlob.signedBlob - leaks credential, signing_secret