> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores.md).
# New - DSPM: Find data exposure risks without connecting your data stores 🚀
Aikido's Data Exposure Audit is a code-based DSPM. It helps developers and AppSec teams find sensitive data exposure risks by analyzing application code and related files already connected to Aikido. It uses LLM agents to read your code, mapping out how sensitive data is created, moved, stored, and exposed. It tells developers which code paths create risky data exposure without accessing your production data.
### What it does
* **Finds sensitive data exposure before production.** Identify risky data handling in code before sensitive data lands somewhere it shouldn’t.
* **Maps sensitive data flows.** Follows sensitive fields from sources like request bodies, uploads, DB reads, config, and application logic into sinks like logs, third party APIs, LLM prompts, caches, queues, and storage.
* **Helps identify access risk.** Shows where routes, roles, services, and tenant checks appear to control access to sensitive data.
* **Finds exposures traditional storage analysis can miss.** Unsafe logging, broad API responses, PII in vendor payloads, secrets in frontend bundles, and sensitive data sent to AI systems.
### **What it looks for**
* **Credentials in URLs.** Tokens and API keys in query strings, redirects, and clone URLs, where logs, proxies, and browser history pick them up.
* **API over-exposure.** Endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access.
* **Unsafe logging and exports.** Unredacted PII and secrets in application logs, traces, caches, and dumps.
* **Over-broad third-party and AI sharing.** Customer data and secrets sent to vendors, analytics, LLM prompts, and vector stores beyond what's required.
* **Weak storage.** Regulated data stored unencrypted, or with base64, MD5, and SHA-1 standing in for encryption.
* **Incomplete deletion.** Delete flows that leave downstream records, caches, and related stores intact.
Plus shadow copies in staging and snapshots, over-permissioned IAM roles and OAuth scopes, and unauthenticated data stores. [See the full list](https://help.aikido.dev/ai-code-analysis/what-is-dspm/what-data-exposure-audit-finds) →
### **From finding to fix**
* Every finding includes code evidence, a data flow explanation, the exposure risk, and remediation guidance.
* AutoFix opens a fix PR where the remediation is code-level.
* Re-test any finding to confirm the issue is resolved.
* Runs against the repos you've already connected. No new data source to onboard.
Each Data Exposure Audit uses credits from your Aikido Wallet.
→ Read more about [code-based DSPM](https://help.aikido.dev/ai-code-analysis/what-is-dspm)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.