What we found, who we told, and what happened next.
Every finding below came from ordinary requests to public web addresses. No passwords were guessed, no logins were bypassed, and nothing was changed. Each entry says what was exposed, who we reported it to, and what the system looked like at our last check, with a link to the full write-up.
We found the exposure, told the people responsible, and it was closed.
City of Marietta, Georgia
911 dispatch and utilities
Fixed June 22, 2026
What we found
The city's map server published its live 911 dispatch feed with caller names and phone numbers and the officers on each call, real-time GPS for the city vehicle fleet, and water, sewer, power and stormwater maps that anyone could edit. No login was required.
Who we told
Emailed the night we found it, June 18, 2026. The city's IT address bounced over the holiday weekend, so we escalated by phone and reached the city's deputy director of cybersecurity on June 22.
What happened
The 911 and vehicle GPS feeds were locked within 30 minutes of that call, and the utility maps followed the same day. The city thanked us.
A state map server held citizen environmental reports, such as drought and landslide reports with the reporter's contact details, and anyone on the internet could edit or delete those records.
Who we told
June 22, 2026, to the agency, the Vermont State CISO and the Attorney General's breach notification office.
What happened
The State CISO replied in 35 minutes. By the end of the day the server required a sign-in and the editable service was gone.
Two of the city's property assessment map services let anyone on the internet add, change or delete parcel records.
Who we told
June 22, 2026, to the city's IT and security teams, the Massachusetts state security operations center and CISA. We escalated to the City CISO and CIO on July 3, and the CISO replied that day.
What happened
Editing was turned off. At our September 30 recheck, every property assessment service was read-only.
No public write-up
Town of Jupiter, Florida
Water and utilities
Fixed, confirmed Sep 16, 2026
What we found
The town's map server exposed 32 services. At least 11 of them, covering water treatment and distribution, sewer, stormwater, energy and public works, let anyone create, change or delete records.
Who we told
July 2, 2026, to the town, the Florida Cybersecurity Operations Center and CISA. The town's own addresses bounced. Florida's security operations center confirmed receipt and passed it on.
What happened
Our August follow-up found the fix still unconfirmed. The fix was confirmed on September 16, and at our September 30 recheck the utility editing services were gone and the town's remaining public map layers were read-only.
The department published its officer intranet in a public code repository. It contained about four months of call-sheet logs, officer schedules, court and defendant details, personal information, and embedded keys for the department's own systems.
Who we told
By phone, then in writing to the Chief of Police.
What happened
The repository was taken down within about a day. We advised rotating every key that had been exposed.
The sheriff's dispatch map server ran over unencrypted HTTP with no login. It exposed 17 map layers, including 26,131 addresses from the 911 dispatch address database.
Who we told
June 22, 2026, to the sheriff's office and the Texas Cybersecurity Coordinator's office.
What happened
We got no reply. At our September 30 recheck, the dispatch map service had been removed.
No public write-up
Reported, still open2
We reported these and published them. At our last check, they were still exposed.
State of California
State government
Still open
What we found
A state map server running an unsupported, out-of-date version published the boundaries of 148 U.S. military installations in a folder named IntelligenceMilitary, with no login.
Who we told
June 23, 2026, to the state threat assessment center (Cal CSIC, part of Cal OES), with CISA copied. The state's own vulnerability program marked the report "not applicable" on July 3.
What happened
No one from the state replied. At our September 30 recheck, the military installations layer was still published on the same outdated server.
Ten EPA map servers showed their full service listings to anyone, and one of them was a test environment left on the public internet.
Who we told
June 24, 2026, to EPA IT security, with CISA copied. An EPA analyst asked us to resubmit through the EPA's Bugcrowd program, and we did that the same day.
What happened
At our September 30 recheck, the service listings were still public, including the test folder.
These changed without a report from us: one closed after we published, and two went offline.
Parliament of Albania
National government
Closed after we published
What we found
The Parliament's public data API served about 32 GB with no login: 236 records of sitting MPs with personal details, seven years of MP salary workbooks, and 30,455 documents.
Who we told
We published the finding on May 13, 2026.
What happened
By June 19, all six open endpoints had stopped returning data. The government made no statement.
In February 2026, a FUNVISIS survey server hosted by the science ministry answered requests for an AWS credentials file and a full database dump. We did not download either file.
Who we told
Venezuela has no working channel for reporting vulnerabilities.
What happened
By June 28, after the June 24 earthquakes, the server had disappeared and its address had been given to another site.
@weezerosint found these and disclosed them to the four platforms in March 2026. We verified the findings and rechecked them three times over 75 days. None of the platforms replied.
Tucker Carlson NetworkFixed
Its database could be read with the public key in the page source: 7,290 subscriber profiles and 15,960 chat messages. It was patched on April 30, after the public post.
NewsmaxFixed
An endpoint exposed account information, and someone had already defaced two of the accounts. It was quietly patched.
MinnectPartly fixed
An endpoint serving 290,000 user records with home addresses now requires a login. Staff accounts and 1,268 expert records with private message channel IDs were still open on June 10.
ValuetainmentStill open
About 75,000 member email addresses are built into public sitemap URLs that Google indexes. Nothing had changed as of June 10.
Banned.VideoPartly fixed
An exposed IP address field was removed. We have not confirmed whether the viewing-history exposure was fixed.
Our wider investigations, mostly of foreign governments, where there was no working channel to report to. Newest first.
Mexico
Ciudad Juárez 911 dispatch
One public map service held 7,976,709 emergency calls going back to 2019, about 36 GB, with caller names, phone numbers, and the responding unit and sector for each call. It was published before notifying Mexico's CERI, because Mexico no longer has an independent authority to report to.
A contractor's public GitHub repository held the license-plate reader platform built for the Northern California Regional Intelligence Center: 1,183 Flock camera locations, the tool that pulls plate reads from Flock, and the system's cloud configuration.
The carrier's 422 MB source code repository was public, with database credentials. It also ran a years-old service desk with a known remote-code flaw. Every police station in the country was mapped on an open map server.
One WordPress platform runs potentially hundreds of government sites, and all of them share one hard-coded encryption key that was published on a public GitLab. Every contact form was open to SQL injection, and public comments exposed 691 national ID numbers and 659 government staff email addresses.
An open government web server held 86,578 national ID records. Across more than 40 government sites we found 688 MB of public files, database credentials, and leaked staff email addresses.
Anyone could query the national procurement database with no login: 83,770 procurement records, 78,621 bidders and 2,101 companies with tax IDs. Also exposed were 4,611 job applicants' CVs at a bank and a police training site that accepted guest:guest.
We probed 934 state domains and found nothing actionable: the perimeter is hardened. Two non-government sites, the Russian Olympic Committee and Petrovax Pharm, exposed .git configuration files.
The ministry's public blacklist of dismissed public servants lists 689 active records with names, national ID numbers and the reason for dismissal, open to anyone.
The President's office ran an open map server with military intelligence maps, armed-group territory, and the locations of 24 FARC reintegration camps. The National Police had an AI platform on AWS with exposed account credentials. In total, 26 GB was open.
Across 2,052 domains we found 31,684 payment records, 5,313 student records with national IDs, and 805 bank branches mapped by GPS. An earlier pass of 131 domains exposed the University of Havana's own IT security team through its WordPress site.
One open repository served data for 177 federal agencies with no login: 186 million records and 64 GB, including 60 million birth records and 25 million death records.
We scanned 1,261 government domains and documented 3,043 exposed credential sets. We also found 1,909 credentials hard-coded in production source code and recovered 8,483 developer identities from git history.
We collected 85,151 records from China's commercial space-tracking catalog: objects, debris, rocket bodies, orbital elements and 53 satellite constellations.
We found 30 production database credential sets, 15 government source code repositories (91,781 files), an election management API that could create admins, the national water infrastructure database, and 24,608 payroll records. We tried to disclose through diplomatic and CERT channels and got no response.
A one-person Miami company presented itself as a Venezuelan CERT. It sold scraped breach-forum data through an API with no authentication and committed stolen API tokens to a public GitHub repository.
Across 35+ government domains, nine sites exposed their user lists, and the capital's VPN and Exchange portals were exposed. We recovered 15 staff email addresses.
Open reconnaissance only. No exploits, no stolen credentials, no getting around a login.
Find
Only public addresses and ordinary web requests. If a system asks for a password, we stop.
Report
A written report to whoever runs the system, with steps to fix it. State or federal security teams are copied when a public body is involved. If no one answers, we call.
Recheck
We recheck every finding after the report. We only call a finding fixed when the exposure stops answering.
Publish
We publish what was exposed, who we told, and the outcome, all dated. The data itself is never published or shared.
Statuses checked September 30, 2026. Every write-up is on ringmast4r.substack.com.