> For the complete documentation index, see [llms.txt](https://help.aikido.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores.md). # DSPM: Find data exposure risks without connecting your data stores 4 Aug 2026 Aikido's Data Exposure Audit is a code-based DSPM. It helps developers and AppSec teams find sensitive data exposure risks by analyzing application code and related files already connected to Aikido. It uses LLM agents to read your code, mapping out how sensitive data is created, moved, stored, and exposed. It tells developers which code paths create risky data exposure without accessing your production data.
### What it does * **Finds sensitive data exposure before production.** Identify risky data handling in code before sensitive data lands somewhere it shouldn’t. * **Maps sensitive data flows.** Follows sensitive fields from sources like request bodies, uploads, DB reads, config, and application logic into sinks like logs, third party APIs, LLM prompts, caches, queues, and storage. * **Helps identify access risk.** Shows where routes, roles, services, and tenant checks appear to control access to sensitive data. * **Finds exposures traditional storage analysis can miss.** Unsafe logging, broad API responses, PII in vendor payloads, secrets in frontend bundles, and sensitive data sent to AI systems. ### **What it looks for** * **Credentials in URLs.** Tokens and API keys in query strings, redirects, and clone URLs, where logs, proxies, and browser history pick them up. * **API over-exposure.** Endpoints returning more fields than the caller is entitled to, and missing tenant ownership checks on data access. * **Unsafe logging and exports.** Unredacted PII and secrets in application logs, traces, caches, and dumps. * **Over-broad third-party and AI sharing.** Customer data and secrets sent to vendors, analytics, LLM prompts, and vector stores beyond what's required. * **Weak storage.** Regulated data stored unencrypted, or with base64, MD5, and SHA-1 standing in for encryption. * **Incomplete deletion.** Delete flows that leave downstream records, caches, and related stores intact. Plus shadow copies in staging and snapshots, over-permissioned IAM roles and OAuth scopes, and unauthenticated data stores. [See the full list](https://help.aikido.dev/ai-code-analysis/what-is-dspm/what-data-exposure-audit-finds) → ### **From finding to fix** * Every finding includes code evidence, a data flow explanation, the exposure risk, and remediation guidance. * AutoFix opens a fix PR where the remediation is code-level. * Re-test any finding to confirm the issue is resolved. * Runs against the repos you've already connected. No new data source to onboard. Each Data Exposure Audit uses credits from your Aikido Wallet. → Read more about [code-based DSPM](https://help.aikido.dev/ai-code-analysis/what-is-dspm) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.aikido.dev/changelog/q3-2026/new-dpsm-find-data-exposure-risks-without-connecting-your-data-stores.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.