Ctrlk
Changelog NotificationsAPIAikido login
For the complete documentation index, see llms.txt. This page is also available as Markdown.

New - DSPM: Find data exposure risks without connecting your data stores 🚀

4 Aug 2026

Aikido's Data Exposure Audit is a code-based DSPM. It helps developers and AppSec teams find sensitive data exposure risks by analyzing application code and related files already connected to Aikido. It uses LLM agents to read your code, mapping out how sensitive data is created, moved, stored, and exposed. It tells developers which code paths create risky data exposure without accessing your production data.

What it does

  • Finds sensitive data exposure before production. Identify risky data handling in code before sensitive data lands somewhere it shouldn’t.

  • Maps sensitive data flows. Follows sensitive fields from sources like request bodies, uploads, DB reads, config, and application logic into sinks like logs, third party APIs, LLM prompts, caches, queues, and storage.

  • Helps identify access risk. Shows where routes, roles, services, and tenant checks appear to control access to sensitive data.

  • Finds exposures traditional storage analysis can miss. Unsafe logging, broad API responses, PII in vendor payloads, secrets in frontend bundles, and sensitive data sent to AI systems.

What it looks for

  • Credentials in URLs. Tokens and API keys in query strings, redirects, and clone URLs, where logs, proxies, and browser history pick them up.

  • API over-exposure. Endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access.

  • Unsafe logging and exports. Unredacted PII and secrets in application logs, traces, caches, and dumps.

  • Over-broad third-party and AI sharing. Customer data and secrets sent to vendors, analytics, LLM prompts, and vector stores beyond what's required.

  • Weak storage. Regulated data stored unencrypted, or with base64, MD5, and SHA-1 standing in for encryption.

  • Incomplete deletion. Delete flows that leave downstream records, caches, and related stores intact.

Plus shadow copies in staging and snapshots, over-permissioned IAM roles and OAuth scopes, and unauthenticated data stores. See the full list →

From finding to fix

  • Every finding includes code evidence, a data flow explanation, the exposure risk, and remediation guidance.

  • AutoFix opens a fix PR where the remediation is code-level.

  • Re-test any finding to confirm the issue is resolved.

  • Runs against the repos you've already connected. No new data source to onboard.

Each Data Exposure Audit uses credits from your Aikido Wallet.

→ Read more about code-based DSPM

Last updated

Was this helpful?