Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
CreateDataSource.Credentials.CredentialPair.{Username,Password} / CopySourceArn / SecretArn - leaks password, database_credential, credential, connection_string
DescribeDataSet.DataSet.PhysicalTableMap.<id>.CustomSql.SqlQuery - leaks credential, password, api_key, sensitive_data, pii
GenerateEmbedUrlForRegisteredUser.EmbedUrl - leaks bearer_token, session_token, credential
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
GetPermission.permission.permission - leaks credential, sensitive_data
GetResourceShares.resourceShares[].tags[].value - leaks credential, sensitive_data
rds-data:ExecuteStatement.records / formattedRecords - leaks credential, password, api_key, connection_string, customer_data, pii
DownloadDBLogFilePortion.LogFileData - leaks credential, password, sensitive_data, pii
DescribeDBParameters.Parameters[].ParameterValue - leaks credential, password, connection_string, sensitive_data
CreateDBInstance.MasterUserPassword / ModifyDBInstance.MasterUserPassword / CreateDBCluster.MasterUserPassword / ModifyDBCluster.MasterUserPassword - leaks password, database_credential, credential
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data, pii
DescribeClusterParameters.Parameters[].ParameterValue - leaks credential, password, connection_string, sensitive_data
redshift-data:GetStatementResult.Records - leaks credential, password, api_key, customer_data, pii
CreateCluster.MasterUserPassword / ModifyCluster.MasterUserPassword - leaks password, database_credential, credential
DescribeTags.TaggedResources[].Tag.Value - leaks credential, sensitive_data
redshift-data:DescribeStatement.QueryString - leaks credential, password, sensitive_data
GetClusterCredentials.DbPassword - leaks password, database_credential, credential
GetProfile.profile.sessionPolicy - leaks credential, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
CreateSession.CredentialSet[].Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
GetHealthCheck.HealthCheck.HealthCheckConfig.SearchString - leaks credential, api_key, sensitive_data
ListTagsForResource.ResourceTagSet.Tags[].Value - leaks credential, sensitive_data
CloudWatch Logs Route 53 query log event.message - leaks pii, sensitive_data, credential
ListResourceRecordSets.ResourceRecordSets[].ResourceRecords[].Value - leaks credential, api_key, certificate, sensitive_data
GetBucketPolicy.Policy - leaks credential, sensitive_data, pii
GetBucketTagging.TagSet[].Value - leaks credential, sensitive_data
GetObject.Body - leaks credential, password, api_key, access_key, secret_key, oauth_token, private_key, connection_string, customer_data, source_code_secret
GetObjectTagging.TagSet[].Value - leaks credential, sensitive_data, pii
HeadObject.Metadata.<value> - leaks credential, api_key, sensitive_data, pii
GetBucketWebsite.RoutingRules[].Redirect.ReplaceKeyWith / Redirect.HostName - leaks credential, api_key, sensitive_data
CloudWatch Logs SageMaker training/processing/inference log event.message - leaks credential, password, api_key, customer_data, pii, source_code_secret
DescribeModel.PrimaryContainer.Environment / Containers[].Environment - leaks credential, password, api_key, access_key, secret_key, connection_string
Notebook Instance or Studio EFS home-directory files - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret, customer_data
DescribeNotebookInstanceLifecycleConfig.NotebookInstanceLifecycleConfig.OnCreate[].Content / OnStart[].Content - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret
DescribePipeline.PipelineDefinition - leaks credential, password, api_key, connection_string, source_code_secret
DescribeProcessingJob.Environment - leaks credential, password, api_key, access_key, secret_key, connection_string
ListTags.Tags[].Value - leaks credential, sensitive_data
DescribeStudioLifecycleConfig.StudioLifecycleConfigContent - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string
DescribeTrainingJob.Environment / HyperParameters - leaks credential, password, api_key, access_key, secret_key, connection_string, sensitive_data
DescribeTransformJob.Environment - leaks credential, password, api_key, access_key, secret_key, connection_string
GetResourcePolicy.ResourcePolicy - leaks credential, sensitive_data
DescribeSecret.Description - leaks credential, sensitive_data, pii
DescribeSecret.Tags[].Value - leaks credential, sensitive_data, pii
BatchGetSecretValue.SecretValues[].SecretString / SecretValues[].SecretBinary - leaks credential, password, api_key, access_key, secret_key, oauth_token, private_key, connection_string, sensitive_data
GetSecretValue.SecretString / SecretBinary - leaks credential, password, api_key, access_key, secret_key, oauth_token, private_key, connection_string, sensitive_data
BatchGetAutomationRules.Rules[].Actions[].FindingFieldsUpdate.{Note,UserDefinedFields} - leaks credential, password, api_key, sensitive_data
BatchImportFindings request.Findings[] - leaks credential, password, api_key, access_key, pii, sensitive_data, customer_data
GetFindings.Findings[].{Note.Text,UserDefinedFields,Resources[].Details.Other,Description,Remediation.Recommendation.Text} - leaks credential, password, api_key, access_key, pii, sensitive_data, customer_data
ListTagsForResource.Tags.<value> - leaks credential, sensitive_data
DescribeRecord.RecordOutputs[].OutputValue - leaks credential, password, api_key, connection_string, sensitive_data