> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/prevention-tools/credentials/exposed-data.md).

# Exposed Data

Exposed Data is the full intelligence feed: every piece of data Stoïk has found leaked about your organisation online.

## Sub-tabs

Exposed Data is organised into three sub-tabs:

* **Raw logs:** every leak record, all data types (credentials, cookies, emails, phone numbers, IP addresses, …).
* **Credentials:** credential-type leaks only: URL + login + password.
* **Cookies:** session cookies exfiltrated from infected devices.

For each entry, the side panel shows the intelligence provider that found it, the estimated leak date, the data type, and any linked alert.

Review new entries and acknowledge them once investigated. Acknowledged entries remain visible but no longer count as new.

{% hint style="info" %}
An entry in Exposed Data does not necessarily mean the credential still works today. If we have confirmed it does, it appears as a [Valid Credentials](/prevention-tools/credentials/valid-credentials.md) alert in the Alerts tab.
{% endhint %}

## Reading an entry

* **Domain:** the website the credentials give access to. `microsoftonline.com` means a Microsoft account. On older Flare entries it is the domain Stoïk searched instead, because Flare does not say which site the leak came from.
* **Password and Encrypted password:** when both are listed, only an encrypted (hashed) password leaked. There is no clear-text password.

## Troubleshooting

<details>

<summary>I don't recognise an email address</summary>

The usual explanations:

* **A former employee:** the leak is older than the deletion of the mailbox.
* **Someone signed up on a website with your domain without owning the address:** many sites never check the email. If that account works, make a discard request and ask the site to stop using your domain.
* **Fake data:** sellers pad leaks to make them look bigger. Typical signs are subdomains that don't exist (`@www.client.fr`, `@pro.client.fr`) and passwords that all follow the same pattern. Mark the entries as Acknowledged.

</details>

<details>

<summary>I don't recognise a domain</summary>

It was usually added to the External Scan and later removed, or it redirects to one of your domains. After each scan, domains the External Scan no longer finds are removed from Credentials, with their results: restart the scan.

If the domain is still there once the scan has finished, or you only excluded it, contact <protect@stoik.io>.

</details>

<details>

<summary>A leak is missing in Stoïk Protect</summary>

* The Valid Credentials tab only lists passwords Stoïk confirmed still work. Every leak is under `Exposed Data` > `Raw logs`.
* Exposed Data only shows new entries by default. If a page says no cookies were found, or "show N more logins" opens an empty list, tick **Acknowledged** in the filters.

If it is still missing, contact <protect@stoik.io> with the email address concerned.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/prevention-tools/credentials/exposed-data.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.