Flock Safety exposed hardcoded API key across 53 public assets, granting unrestricted access to surveillance data from 12,000 police departments, communities and businesses nationwide; vulnerability now fixed after disclosure.

53 Times Flock Safety Hardcoded the Password for America's Surveillance Infrastructure

VendorFlock SafetyAffected ProductsFlock Safety's ArcGIS, FlockOS, Aerodome, Flock911Vulnerability TypeHardcoded API Key Exposure (CWE-798)Exposure Count53 separate instances across public-facing assets compromising 50 data layersData at Risk~5,000 police departments, ~6,000 community deployments, and ~1,000 private businessesStatusRemediated following responsible disclosureExecutive SummaryI discovered a Default ArcGIS API key embedded in Flock Safety's public-facing JavaScript bundles. This si...