> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/ai-code-analysis/what-is-dspm/data-exposure-audit.md).

# Run a Data Exposure Audit

A **Data Exposure Audit** is Aikido's code-based DSPM. It runs inside [AI Code Analysis](/ai-code-analysis/ai-code-analysis.md) and reasons over your repositories to find how sensitive data is handled and where it may be exposed, without connecting to your databases.

### Use cases

* **Map sensitive data in code**: See how PII, secrets, tokens, and customer data move through your app
* **Catch exposure before it ships**: Find unsafe logging, over-broad APIs, and third-party sharing from source
* **Fix the source of the leak**: Get evidence and remediation in code, without connecting your databases
* **Support privacy and compliance reviews**: Tie data handling gaps back to concrete code paths

### Prerequisites

* You have the Manage Pentests and AI Code Analysis [permission](/getting-started/automated-user-management/setting-roles-and-permissions.md)
* At least one repository is connected.
* Your wallet has enough credits for the quoted cost. See [Wallet & Credits](/miscellaneous-info/wallet-and-credits.md)

### Run a Data Exposure Audit

{% stepper %}
{% step %}

#### Open AI Code Analysis

In Aikido, go to [**AI Code Analysis**](https://app.aikido.dev/agentic-review), then click **Create Audit**.
{% endstep %}

{% step %}

#### Select Data Exposure Audit Type

<figure><img src="/files/FlIwcuQ5PKHd4c6B7qtw" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Select repositories

For monorepos, click **Exclude Paths** next to a selected repository to remove directories that aren't part of the application you want to audit. For example, exclude unrelated applications or services so Aikido can focus on the code that handles your sensitive data.

<figure><img src="/files/joFFPIhGoVA3sarGqf7U" alt="Exclude Paths button next to a selected repository"><figcaption></figcaption></figure>

{% hint style="info" %}
Exclude unrelated applications or services, not documentation, READMEs, or other non-code assets. Those files can provide useful context about data flows, integrations, and how sensitive data is handled.
{% endhint %}

You can also add **additional notes**. The audit usually runs fine without them, as agents already pull a lot of context from your source and understand the application well. Use notes when relevant context is missing from the code, such as:

* Known gaps
* Intended quirks
* Production configuration that isn't in the repo but matters for the audit

That context helps the agents triage and prioritize findings more accurately.

<figure><img src="/files/FVFFUdv4tmteJxSMEhUp" alt=""><figcaption></figcaption></figure>
{% endstep %}

{% step %}

#### Confirm pricing and start

Review the credit estimate on the **Pricing** step. Top up with **Add Credits** if needed, then click **Start Audit**.
{% endstep %}
{% endstepper %}

Aikido opens the assessment detail page so you can follow progress and read findings as they land.

<figure><img src="/files/OviguU4UuvwPKhtEmHJd" alt=""><figcaption></figcaption></figure>

### What it finds

Each finding includes a summary, root cause, remediation, and code-based **Evidence**. For the full list of data-handling classes in scope, from plaintext storage and unsafe logging to over-broad APIs and AI sharing, see [What Data Exposure Audit Finds](/ai-code-analysis/what-is-dspm/what-data-exposure-audit-finds.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.aikido.dev/ai-code-analysis/what-is-dspm/data-exposure-audit.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.