Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
DescribeTags.Tags[].Value - leaks credential, sensitive_data, pii
GetPasswordData.PasswordData - leaks password, credential
GetDownloadUrlForLayer.downloadUrl -> layer tar contents - leaks source_code_secret, credential, password, api_key, access_key, secret_key, private_key
BatchGetImage.images[].imageManifest - leaks source_code_secret, credential, password, api_key, sensitive_data
GetRepositoryPolicy.policyText - leaks credential, sensitive_data
ListTagsForResource.tags[].Value - leaks credential, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
DescribeTasks.tasks[].overrides.containerOverrides[].environment[].value / command - leaks credential, password, api_key, connection_string
DescribeTaskDefinition.taskDefinition.containerDefinitions[].command / entryPoint / healthCheck.command - leaks credential, password, api_key, connection_string
DescribeTaskDefinition.taskDefinition.containerDefinitions[].dockerLabels.<value> - leaks credential, password, api_key, connection_string, sensitive_data
DescribeTaskDefinition.taskDefinition.containerDefinitions[].environment[].value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeTaskDefinition.taskDefinition.containerDefinitions[].logConfiguration.options.<value> - leaks credential, api_key, bearer_token, connection_string
Mounted EFS file bytes - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, customer_data, source_code_secret
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeAddon.addon.configurationValues - leaks credential, password, api_key, connection_string, sensitive_data
DescribeCluster.cluster.tags.<value> - leaks credential, sensitive_data
Kubernetes core/v1 ConfigMap.data / binaryData - leaks credential, password, api_key, connection_string, sensitive_data
Kubernetes core/v1 Secret.data / stringData - leaks credential, password, api_key, access_key, secret_key, oauth_token, private_key, certificate, connection_string
Kubernetes PodTemplateSpec.containers[].env[].value / command / args - leaks credential, password, api_key, connection_string
CreateReplicationGroup.AuthToken / ModifyReplicationGroup.AuthToken - leaks password, credential
Redis GET/MGET/SCAN or Memcached get response value - leaks credential, password, api_key, session_token, connection_string, customer_data
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
CreateUser.Passwords[] / ModifyUser.Passwords[] - leaks password, credential
S3 ELB/ALB/NLB access log object body - leaks credential, api_key, bearer_token, session_token, pii, sensitive_data
DescribeRules.Rules[].Actions[].FixedResponseConfig.MessageBody - leaks credential, api_key, sensitive_data
CreateListener.Actions[].AuthenticateOidcConfig.ClientSecret / ModifyListener.Actions[].AuthenticateOidcConfig.ClientSecret - leaks secret_key, oauth_token, credential
DescribeRules.Rules[].Actions[].RedirectConfig.{Host,Path,Query} - leaks credential, api_key, bearer_token, sensitive_data
DescribeTags.TagDescriptions[].Tags[].Value - leaks credential, sensitive_data
ListBootstrapActions.BootstrapActions[].Args - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeCluster.Cluster.Configurations[].Properties / Configurations[] - leaks credential, password, api_key, connection_string, sensitive_data
S3 or CloudWatch EMR step/bootstrap/application log - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
DescribeCluster.Cluster.Tags[].Value - leaks credential, sensitive_data
emr-serverless:GetJobRun.jobRun.jobDriver / configurationOverrides - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeStep.Step.Config.Args / Properties - leaks credential, password, api_key, access_key, secret_key, connection_string
CreateConnection.AuthorizationParameters BasicAuth.Password / ApiKeyAuth.ApiKeyValue / OAuth.ClientParameters.ClientSecret - leaks password, api_key, oauth_token, secret_key, credential
PutEvents request.Entries[].Detail - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeRule.EventPattern - leaks credential, api_key, sensitive_data
ListTargetsByRule.Targets[].Input / Targets[].InputTransformer.InputTemplate / Targets[].HttpParameters.HeaderParameters / Targets[].HttpParameters.QueryStringParameters - leaks credential, password, api_key, bearer_token, connection_string, sensitive_data
scheduler:GetSchedule.Target.Input - leaks credential, password, api_key, bearer_token, customer_data, sensitive_data
GetPolicy.Policy.SecurityServicePolicyData.ManagedServiceData - leaks credential, api_key, connection_string, sensitive_data
GetPolicy.Policy.ResourceTags[].Value - leaks credential, sensitive_data, pii
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
Mounted FSx file or object bytes (SMB/NFS/Lustre/ONTAP/OpenZFS) - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, customer_data, source_code_secret
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
CreateFileSystem.WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password - leaks password, credential
CreateStorageVirtualMachine.SvmAdminPassword / UpdateStorageVirtualMachine.SvmAdminPassword - leaks password, credential
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
GetConnection.Connection.ConnectionProperties.{USERNAME,PASSWORD,JDBC_CONNECTION_URL,CUSTOM_*} - leaks credential, password, connection_string, database_credential, api_key, oauth_token
GetTable.Table.StorageDescriptor.Parameters / SerdeInfo.Parameters / Table.Parameters - leaks credential, password, connection_string, sensitive_data