Flock Safety's own website would hand an access token to any visitor who requested one. A researcher requested one. What followed was a copy of the company's device database, listing 335,701 installed cameras.
The flaw let Joshua Michael reach that database indirectly. Rather than attacking Flock's servers, he pointed the token at ArcGIS, the geospatial service sitting underneath the company's stack, and pulled a list of installed units in November 2025.
Michael reported it straight away. In a note dated November 13, he stressed that nothing had been intrusive: no credentials broken, no records edited, no billable queries triggered. Flock replied once, saying the findings were being triaged. Later emails went unanswered.
A patch landed in January, weeks after Michael published. By then his copy was out of the building and powering the Flock Surveillance Map, a site that plots the installed base.
Ask Flock and nothing was breached, and no customer information surfaced. Michael calls that account incomplete. He sees only two options left: someone inside knew the database had been copied and chose silence, or nothing in the company's monitoring registered the extraction at all. He labels the first a transparency failure, the second a detection failure carrying national security consequences.
His write-up also weighs exposure around sensitive sites. Twenty-two matter most, among them the Pentagon, CIA headquarters, FBI headquarters, Joint Base Andrews and Eglin Air Force Base. Michael calculates that people living within 20 miles of those locations face a 57.22% to 93.94% chance of driving past a camera that records them.
Legal pressure arrived instead of a technical answer. A social engineering defense firm named Doppel wrote to Michael stating that the Flock Safety trademark was being used without authorization, and asked that the map be pulled down.
