Exposure DB
1,048 exposure sites - every place a customer-controlled credential or secret can leak - each mapped to the edge it emits, its collection recipe, and what leaks.
406
aws
377
azure
265
gcp
563
critical severity
250
medium severity
233
high severity
2
low severity
DescribeProvisioningArtifact.Info.LoadTemplateFromURL -> CloudFormation template - leaks credential, password, api_key, access_key, secret_key, connection_string, source_code_secret
ListTagOptions.TagOptionDetails[].Value - leaks credential, sensitive_data, pii
GetEndpointAttributes.Attributes.CustomUserData - leaks credential, sensitive_data, pii
GetPlatformApplicationAttributes.Attributes.PlatformCredential / PlatformPrincipal - leaks private_key, secret_key, oauth_token, credential
Publish request.Message / MessageAttributes - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
ListSubscriptionsByTopic.Subscriptions[].Endpoint - leaks credential, api_key, webhook_secret, sensitive_data, pii
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
ReceiveMessage.Messages[].MessageAttributes[].StringValue / BinaryValue - leaks credential, api_key, bearer_token, sensitive_data, pii
ReceiveMessage.Messages[].Body - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, customer_data, pii
GetQueueAttributes.Attributes.Policy - leaks credential, sensitive_data
ListQueueTags.Tags.<value> - leaks credential, sensitive_data
DescribeAssociation.AssociationDescription.Parameters - leaks credential, password, api_key, connection_string
GetAutomationExecution.AutomationExecution.Parameters / Outputs - leaks credential, password, api_key, connection_string, sensitive_data
GetCommandInvocation.StandardOutputContent / StandardErrorContent - leaks credential, password, api_key, access_key, secret_key, private_key, sensitive_data
ListCommands.Commands[].Parameters - leaks credential, password, api_key, access_key, secret_key, connection_string
GetDocument.Content - leaks credential, password, api_key, access_key, secret_key, private_key, connection_string, source_code_secret
GetMaintenanceWindowTask.TaskInvocationParameters - leaks credential, password, api_key, connection_string
GetOpsItem.OpsItem.OperationalData.<key>.Value - leaks credential, password, api_key, connection_string, sensitive_data, pii
DescribeParameters.Parameters[].Description - leaks credential, sensitive_data
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
GetParameter.Parameter.Value - leaks credential, password, api_key, access_key, secret_key, oauth_token, connection_string, sensitive_data
GetParameterHistory.Parameters[].Value - leaks credential, password, api_key, access_key, secret_key, connection_string, sensitive_data
ListTagsForResource.TagList[].Value - leaks credential, sensitive_data
CloudWatch Logs/S3 Session Manager transcript - leaks credential, password, api_key, access_key, secret_key, private_key, sensitive_data
identitystore:DescribeGroup.Description - leaks credential, sensitive_data
sso-admin:GetInlinePolicyForPermissionSet.InlinePolicy - leaks credential, sensitive_data
sso-admin:ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
identitystore:DescribeUser.{UserName,DisplayName,Emails[],PhoneNumbers[],Addresses[]} - leaks pii, sensitive_data, credential
GetActivityTask.input - leaks credential, password, api_key, bearer_token, customer_data, pii
GetExecutionHistory.events[].*EventDetails.input / output / parameters / Result / cause - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
DescribeExecution.input / output - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
CloudWatch Logs Step Functions Express execution log event.message - leaks credential, password, api_key, customer_data, pii, sensitive_data
ListTagsForResource.tags[].value - leaks credential, sensitive_data
DescribeStateMachine.definition - leaks credential, password, api_key, access_key, secret_key, connection_string, source_code_secret
AssumeRole.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
AssumeRole request.ExternalId - leaks credential, sensitive_data
GetFederationToken.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
AssumeRoleWithSAML.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
AssumeRoleWithWebIdentity.Credentials.SecretAccessKey / SessionToken - leaks access_key, secret_key, session_token, credential
DescribeTags.Tags[].Value - leaks credential, sensitive_data
timestream-query:Query.Rows[].Data[].ScalarValue - leaks credential, password, api_key, session_token, connection_string, customer_data, pii
ListTagsForResource.Tags[].Value - leaks credential, sensitive_data
DescribeScheduledQuery.ScheduledQuery.QueryString - leaks credential, password, api_key, sensitive_data
DescribeTags.Tags[].Value - leaks credential, sensitive_data
Traffic Mirror target packet capture - leaks credential, password, api_key, bearer_token, session_token, customer_data, pii
DescribeVpcEndpoints.VpcEndpoints[].PolicyDocument - leaks credential, sensitive_data
DescribeVpnConnections.VpnConnections[].CustomerGatewayConfiguration - leaks password, signing_secret, credential, sensitive_data
CloudWatch Logs/S3/Firehose VPC Lattice access log record - leaks credential, api_key, bearer_token, session_token, pii, sensitive_data
GetAuthPolicy.policy - leaks credential, api_key, sensitive_data
ListTagsForResource.tags.<value> - leaks credential, sensitive_data