Ctrlk
Changelog NotificationsAPIAikido login
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Run a Data Exposure Audit

A Data Exposure Audit is Aikido's code-based DSPM. It runs inside AI Code Analysis and reasons over your repositories to find how sensitive data is handled and where it may be exposed, without connecting to your databases.

Use cases

  • Map sensitive data in code: See how PII, secrets, tokens, and customer data move through your app

  • Catch exposure before it ships: Find unsafe logging, over-broad APIs, and third-party sharing from source

  • Fix the source of the leak: Get evidence and remediation in code, without connecting your databases

  • Support privacy and compliance reviews: Tie data handling gaps back to concrete code paths

Prerequisites

  • You have the Manage Pentests and AI Code Analysis permission

  • At least one repository is connected.

  • Your wallet has enough credits for the quoted cost. See Wallet & Credits

Run a Data Exposure Audit

1

Open AI Code Analysis

In Aikido, go to AI Code Analysis, then click Create Audit.

2

Select Data Exposure Audit Type

3

Select repositories

For monorepos, click Exclude Paths next to a selected repository to remove directories that aren't part of the application you want to audit. For example, exclude unrelated applications or services so Aikido can focus on the code that handles your sensitive data.

Exclude Paths button next to a selected repository

Exclude unrelated applications or services, not documentation, READMEs, or other non-code assets. Those files can provide useful context about data flows, integrations, and how sensitive data is handled.

You can also add additional notes. The audit usually runs fine without them, as agents already pull a lot of context from your source and understand the application well. Use notes when relevant context is missing from the code, such as:

  • Known gaps

  • Intended quirks

  • Production configuration that isn't in the repo but matters for the audit

That context helps the agents triage and prioritize findings more accurately.

4

Confirm pricing and start

Review the credit estimate on the Pricing step. Top up with Add Credits if needed, then click Start Audit.

Aikido opens the assessment detail page so you can follow progress and read findings as they land.

What it finds

Each finding includes a summary, root cause, remediation, and code-based Evidence. For the full list of data-handling classes in scope, from plaintext storage and unsafe logging to over-broad APIs and AI sharing, see What Data Exposure Audit Finds.

Last updated

Was this helpful?