Misconfigured Cloud Storage by Provider

Live exposure counts across 21 cloud-storage providers. Click a provider for common misconfiguration patterns, real-world impact, and remediation guidance.

Total indexed exposures: 28,562+. Updated continuously by the scanner.

Read our research on finding and fixing exposed cloud storage →

AWS S3

8,346

Amazon S3 is the most common source of public cloud-storage exposure on the internet.

Firebase Realtime Database

5,951

Firebase Realtime Database (firebaseio.com) is a JSON document store with declarative security rules.

Huawei Cloud OBS

3,976

Huawei Cloud OBS (Object Storage Service) uses an S3-compatible API with buckets at `<bucket>.obs.<region>.myhuaweicloud.com`.

Google Cloud Storage

3,134

Google Cloud Storage exposures usually come from an IAM binding granting the `allUsers` or `allAuthenticatedUsers` principal `Storage Object Viewer` or `Storage Legacy Bucket Reader`.

Wasabi Hot Cloud Storage

2,611

Wasabi positions itself as a cheaper, faster S3 and inherits the S3 misconfig taxonomy.

Yandex Object Storage

976

Yandex Object Storage is S3-compatible and hosted at `<bucket>.storage.yandexcloud.net`.

DigitalOcean Spaces

881

DigitalOcean Spaces is an S3-compatible object store.

Exoscale SOS

597

Exoscale Simple Object Storage (SOS) is S3-compatible and hosted at `sos-<region>.exo.io`.

Linode Object Storage

513

Linode Object Storage is S3-compatible and hosted on `<region>.linodeobjects.com`.

IBM Cloud Object Storage

454

IBM Cloud Object Storage (COS) exposes both an IAM model and a legacy ACL model.

Alibaba Cloud OSS

300

Alibaba Cloud Object Storage Service (OSS) hosts buckets at `<bucket>.oss-<region>.aliyuncs.com`.

Scaleway Object Storage

281

Scaleway Object Storage is S3-compatible and hosted at `s3.<region>.scw.cloud`.

Firebase Cloud Storage

245

Firebase Cloud Storage shares a security-rules model with the Realtime Database but stores object blobs on top of GCS.

Azure Blob Storage

181

Azure Blob Storage exposes data when a container's "Public access level" is set to `blob` (anonymous read of individual blobs) or `container` (anonymous read plus enumerate).

Vultr Object Storage

Vultr Object Storage is S3-compatible.

Hetzner Object Storage

Hetzner's 2024 Object Storage offering is S3-compatible and hosted at `<bucket>.<region>.your-objectstorage.com`.

DreamHost DreamObjects

DreamHost DreamObjects is a Ceph-backed, S3-compatible object store running on `objects-<region>.dream.io`.

Backblaze B2

Backblaze B2 has a binary "bucket type" (`allPublic` or `allPrivate`) set at creation.

Oracle Cloud Object Storage

Oracle Cloud Infrastructure (OCI) Object Storage exposes data when a bucket's "Visibility" is set to `Public`.

Tencent Cloud COS

Tencent Cloud Object Storage (COS) hosts buckets at `<bucket>-<appid>.cos.<region>.myqcloud.com`.

OVH Cloud Object Storage

OVH Cloud Object Storage runs on OpenStack Swift with an S3-compatible facade.

About this index

Misconfigured.app indexes publicly-accessible cloud storage that was misconfigured by its owner. Findings are derived from passive observation of internet-reachable buckets and OSINT sources. No authentication is bypassed, no access controls are circumvented. Findings are continuously re-verified and pruned when remediated.

If you own a bucket listed here and want it removed, submit a takedown request via our contact form (takedowns are processed within 4 hours).