Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
GetContainerServices.containerServices[].tags[].value - leaks credential, sensitive_data
GetRelationalDatabaseMasterUserPassword.masterUserPassword - leaks password, database_credential, credential
GetInstance.instance.tags[].value - leaks credential, sensitive_data
CreateInstances.userData / CreateInstancesFromSnapshot.userData - leaks credential, password, api_key, access_key, secret_key, source_code_secret
GetAllowList.Criteria.Regex / Criteria.S3WordsList.ObjectKey -> S3 object - leaks credential, password, api_key, sensitive_data
GetCustomDataIdentifier.{regex,keywords[],ignoreWords[]} - leaks credential, password, api_key, sensitive_data
GetFindings.findings[].classificationDetails.result.sensitiveData / resourcesAffected - leaks pii, sensitive_data, customer_data
ListTagsForResource.tags.<value> - leaks credential, sensitive_data
GetSensitiveDataOccurrences.sensitiveDataOccurrences.<type>[].value - leaks credential, password, api_key, access_key, secret_key, private_key, pii, sensitive_data, customer_data
Redis OSS GET/MGET/SCAN response value - leaks credential, password, api_key, session_token, connection_string, customer_data
ListTags.Tags[].Value - leaks credential, sensitive_data
CreateUser.AuthenticationMode.Passwords[] / UpdateUser.AuthenticationMode.Passwords[] - leaks password, credential
CloudWatch Logs Amazon MQ general/audit log event.message - leaks credential, password, sensitive_data, pii
AMQP/JMS/STOMP/MQTT message body and headers - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
CreateBroker.Users[].Password / UpdateUser.Password - leaks password, credential
DescribeConfigurationRevision.Data - leaks credential, password, api_key, connection_string, sensitive_data
ListTags.Tags.<value> - leaks credential, sensitive_data
CloudWatch Logs/S3/Firehose MSK broker log record - leaks credential, password, sensitive_data, pii
DescribeConfigurationRevision.ServerProperties - leaks credential, password, connection_string, sensitive_data
ListTagsForResource.Tags.<value> - leaks credential, sensitive_data
Kafka consumer record key/value/headers - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
DescribeDBClusterParameters.Parameters[].ParameterValue - leaks credential, connection_string, sensitive_data
Neptune HTTPS Gremlin/SPARQL/openCypher query result body - leaks credential, password, api_key, customer_data, pii
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
Neptune Streams records - leaks credential, password, api_key, customer_data
CloudWatch Logs/S3/Firehose Network Firewall log record - leaks credential, api_key, bearer_token, customer_data, pii, sensitive_data
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeRuleGroup.RuleGroup.RuleVariables.IPSets[].Definition / PortSets[].Definition - leaks sensitive_data, pii, credential
DescribeRuleGroup.RuleGroup.RulesSource.RulesString - leaks credential, api_key, bearer_token, sensitive_data
CloudWatch Logs OpenSearch application/search-slow/index-slow/audit event.message - leaks credential, password, api_key, bearer_token, customer_data, pii
OpenSearch _search/_mget response _source fields - leaks credential, password, api_key, bearer_token, customer_data, pii, sensitive_data
ListTags.TagList[].Value - leaks credential, sensitive_data
DescribeDomainConfig.DomainConfig.AdvancedSecurityOptions.Options.SAMLOptions.Idp.MetadataContent - leaks certificate, pii, sensitive_data
OpenSearch Serverless _search response _source fields - leaks credential, password, api_key, customer_data, pii
DescribeApps.Apps[].Environment[].Value - leaks credential, password, api_key, access_key, secret_key, connection_string
DescribeApps.Apps[].AppSource.Password / SshKey - leaks password, private_key, credential
DescribeApps.Apps[].SslConfiguration.PrivateKey - leaks private_key, certificate, credential
DescribeDeployments.Deployments[].Command.Args.<value> - leaks credential, password, api_key, connection_string
DescribeRdsDbInstances.RdsDbInstances[].DbPassword - leaks password, database_credential, credential
ListTags.Tags.<value> - leaks credential, sensitive_data
DescribeStacks.Stacks[].CustomJson - leaks credential, password, api_key, connection_string, sensitive_data
DescribeAccount.Account.Email - leaks pii, sensitive_data
DescribePolicy.Policy.Content - leaks credential, sensitive_data
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data, pii
ExportJournalToS3 output S3 objects - leaks credential, password, api_key, customer_data, pii
qldb-session:SendCommand.ExecuteStatement.Result.FirstPage.Values[] - leaks credential, password, api_key, customer_data, pii
ListTagsForResource.Tags.<value> - leaks credential, sensitive_data
DescribeAnalysisDefinition.Definition (filters, parameters, calculated fields, static values) - leaks credential, password, api_key, customer_data, pii, sensitive_data
GenerateEmbedUrlForAnonymousUser.EmbedUrl - leaks bearer_token, session_token, credential
DescribeDashboardDefinition.Definition - leaks credential, password, api_key, customer_data, pii, sensitive_data