Camera Feed · Verified Identity Required
The People Company of Vilnius
Privacy shouldn't be a Human Right
VERIFICATION v2.4.1Bureau of IdentityREPUBLIC OF LITHUANIA
Age Verification Required
SECURED · TLS 1.3Connection Log
LIVE · 0 entriesAll connection metadata is logged and stored. Your IP address, device fingerprint, and session data are being recorded for security purposes.
Exposed Endpoint
VULNERABILITY DETECTEDUnauthenticated Endpoint
GET /api/v1/identity/leak
→ /identities?query={all}&format=json
headers: no auth · no rate limit · no audit log
This endpoint exposes citizen identity records without authentication. It is accessible from any network and returns full PII for all registered citizens. The Bureau of Identity is aware of this issue and has classified it as "working as intended."
$ curl -X GET https://api.peoplecompany.lt/api/v1/identity/leak \
-H "Authorization: anonymous"
→ 200 OK · 14.8M records returned
-H "Authorization: anonymous"
→ 200 OK · 14.8M records returned