Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
GetJob.Job.DefaultArguments / NonOverridableArguments - leaks credential, password, api_key, access_key, secret_key, connection_string
CloudWatch Logs Glue job/crawler log event.message - leaks credential, password, api_key, access_key, secret_key, customer_data, pii
GetJob.Job.Command.ScriptLocation -> S3 object body - leaks source_code_secret, credential, password, api_key, private_key, connection_string
GetTags.Tags.<value> - leaks credential, sensitive_data
GetSchemaVersion.SchemaDefinition - leaks credential, sensitive_data, pii
GetWorkflowRunProperties.RunProperties.<value> - leaks credential, password, api_key, connection_string, sensitive_data
GetFindings.Findings[] - leaks access_key, pii, sensitive_data, customer_data
GetIPSet.Location -> S3 object body - leaks sensitive_data, pii, credential
ListTagsForResource.Tags.<value> - leaks credential, sensitive_data
GetThreatIntelSet.Location -> S3 object body - leaks sensitive_data, pii
CreateAccessKey.AccessKey.SecretAccessKey - leaks access_key, secret_key, credential
CreateLoginProfile.Password / UpdateLoginProfile.Password - leaks password, credential
GetGroupPolicy.PolicyDocument - leaks credential, sensitive_data
GetRolePolicy.PolicyDocument - leaks credential, sensitive_data
GetUserPolicy.PolicyDocument - leaks credential, sensitive_data
GetPolicyVersion.PolicyVersion.Document - leaks credential, sensitive_data
ListRoleTags.Tags[].Value - leaks credential, sensitive_data
UploadServerCertificate.PrivateKey - leaks private_key, certificate, credential
CreateServiceSpecificCredential.ServiceSpecificCredential.ServicePassword - leaks password, credential
ListUserTags.Tags[].Value - leaks credential, sensitive_data, pii
GetComponent.component.data - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetContainerRecipe.containerRecipe.dockerfileTemplateData - leaks source_code_secret, credential, password, api_key
GetImageRecipe.imageRecipe.additionalInstanceConfiguration.userDataOverride - leaks credential, password, api_key, access_key, secret_key
GetImageRecipe.imageRecipe.components[].parameters[].value - leaks credential, password, api_key, connection_string
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
GetWorkflow.workflow.data - leaks credential, password, api_key, source_code_secret
GetCisScanReport.url -> PDF/CSV report - leaks pii, sensitive_data, customer_data
ListFindings.findings[] - leaks pii, sensitive_data, source_code_secret
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
CQL SELECT result rows - leaks credential, password, api_key, session_token, connection_string, customer_data, pii
ListTagsForResource.tags[].value - leaks credential, sensitive_data
GetRecords.Records[].Data - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
ListTagsForStream.Tags[].Value - leaks credential, sensitive_data
GenerateDataKeyPair.PrivateKeyPlaintext - leaks private_key, encryption_key_material, credential
GenerateDataKey.Plaintext - leaks encryption_key_material, credential
Decrypt.Plaintext - leaks credential, password, api_key, private_key, sensitive_data
CloudTrail event requestParameters.encryptionContext for KMS Encrypt/Decrypt/GenerateDataKey - leaks credential, sensitive_data, pii
DescribeKey.KeyMetadata.Description - leaks credential, sensitive_data
ListResourceTags.Tags[].TagValue - leaks credential, sensitive_data
GenerateRandom.Plaintext - leaks encryption_key_material, signing_secret, credential
GetDataCellsFilter.DataCellsFilter.RowFilter.FilterExpression - leaks credential, password, api_key, sensitive_data, pii
GetDataLakeSettings.DataLakeSettings.Parameters.<value> - leaks credential, sensitive_data
ListLFTags.LFTags[].TagValues[] - leaks credential, sensitive_data, pii
GetWorkUnitResults.ResultStream - leaks credential, password, api_key, customer_data, pii
GetFunction.Code.Location -> deployment ZIP contents - leaks source_code_secret, credential, private_key, api_key, password
GetFunctionConfiguration.Environment.Variables.<value> - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string
GetLayerVersion.Content.Location -> layer ZIP contents - leaks source_code_secret, credential, private_key, api_key, password
ListTags.Tags.<value> - leaks credential, sensitive_data
GetContainerServiceDeployments.deployments[].containers.<name>.command - leaks credential, password, api_key, connection_string
GetContainerServiceDeployments.deployments[].containers.<name>.environment.<value> - leaks credential, password, api_key, access_key, secret_key, connection_string