Flock seeks to have security researchers’ map of Flock cameras taken down — Unauthenticated flaw exposed 335,701 camera locations nationwide

If you use Flock cameras, the locations of all 335,701 deployed cameras are now publicly mapped, exposing their placement without your consent.

Security researcher Joshua Michael discovered an unauthenticated vulnerability in Flock's website, allowing him to obtain an access token without logging in. Using this, he created a public map detailing the locations of 335,701 Flock cameras nationwide. Michael reported the flaw to Flock in November 2025, stating his testing was non-intrusive and did not bypass security measures. Flock initially acknowledged the findings but, according to Michael, has not provided further updates or addressed the issue directly. In response to the public map, Flock has initiated a trademark infringement complaint to force the researcher to take down the website. The revealed camera locations could potentially be used to track individuals traveling to sensitive sites, including military bases and intelligence agency headquarters.

The incident highlights a significant gap in Flock's security posture, where an unauthenticated endpoint allowed for the mass extraction of sensitive location data. This breach not only compromises the privacy of individuals and entities using Flock's services but also raises concerns about the broader implications for physical security and surveillance. The company's delayed response and subsequent legal action against the researcher suggest a reactive rather than proactive approach to addressing discovered vulnerabilities, potentially damaging trust with both users and the security community.

This event underscores the critical need for robust security audits and rapid incident response protocols for companies operating in the surveillance technology sector. The exposure of such a large number of camera locations could lead to increased scrutiny from privacy advocates and regulatory bodies, potentially prompting stricter guidelines on data handling and security for similar services. Future developments will likely focus on how Flock addresses its security flaws and whether other similar services have comparable vulnerabilities that could be exploited.