Me *Hiding under the bed*
Armed Robber:
Me:
Armed Robber:
Me:
Armed Robber: Zim Zimma! Who got de keys to mi bimma?
Me: WHO AM I? DE GALS DEM SUGA!🗣🗣🗣🗣
We’re putting out a call for gently used shoes to support those in need at Sandilands Rehabilitation Centre.
If you have any pairs (for men or women) that are still in good condition, we would truly appreciate your donation. Please let me know if you’re able to contribute
On another note.. say what you want about the third party.. that motorcade was huge and given the increase in gas prices and the scorching heat today…. This election is going to be quite interesting!
If it’s one thing I’ve learned this past month working is that majority of the shootings and stabbings that take place go un-reported… thank God for the our healthcare system that does an amazing job in trauma care.. otherwise the homicide count would be double….
I scraped some of the Bahamas voter roll in 14 minutes. Then I mapped every single one of them as best as possible.
6,452 names. Voter IDs. Dates of birth. Home constituencies. 676 API calls. Zero rate limiting. Zero authentication beyond a public key sitting in the page source.
This isn't a hack. There's no exploit. No credentials were stolen. No systems were compromised.
The Bahamas government voter lookup tool has a 2-character minimum search, no rate limiting, and a CORS wildcard (*), meaning anyone, from any website on earth, can query it programmatically and pull data cross-origin without restriction.
I wrote a script that iterated every 2-letter prefix from "aa" to "zz." That's it. 14 minutes later I had the full roll.
What came back per voter: full legal name, voter registration number (used as government-issued ID), year of birth, constituency, polling division, and advance poll status. 8 PII fields per person, served up to anyone with a browser console and basic fetch knowledge.
So I built something to make the implications impossible to ignore.
Using constituency and polling division data alone, no addresses, no GPS, no phone records, I triangulated each voter's approximate physical location to within ~1-4km using a GEOSINT (Geographic Open Source Intelligence) visualization. Every dot on the map is a real person, placed within a polygon near their real neighborhood, derived entirely from "public" civic data.
Here's what an adversary would see when they connect the dots:
- Voter IDs are used for identity verification purposes, that's an identity fraud vector.
- Constituency + polling division = neighborhood-level geolocation without ever needing an address.
- Full name + year of birth + location = a social engineering playbook that practically writes itself.
- Advance poll registration = a confirmed physical location on a specific, known date
This isn't about The Bahamas specifically. Treating voter data as "public record" without considering what happens when public + structured + queryable + unprotected = weaponizable at scale.
The fix is embarrassingly simple:
• Increase the search minimum to 4+ characters
• Add rate limiting (even 10 requests/minute would have stopped this)
• Remove the CORS wildcard
• Require authentication for bulk-capable queries
None of this is hard. None of this is expensive. It just has to actually be done.
⚠️ This project is strictly for educational and awareness purposes. No data was used maliciously. The tool was built to demonstrate the real-world intelligence implications of exposed PII in civic systems so that the people responsible for protecting it understand the urgency.
If you work in election security, government IT, or data protection policy, this can be used with information like info stealers or malware that works together with information from the darknet for even further purposes like social engineering, this is just a very small example of what could evolve into something like a threat before it becomes a headline.
@ValaLegz@SansNevis@phreakydev@secmxx
#CyberSecurity #OSINT #GEOSINT #ElectionSecurity #DataPrivacy #InfoSec