City of Lenexa, KS Exposes Entry Codes to Private Homes, Residential Communities, and Businesses Through Public GIS Dataset

Disclaimer

If you are reading this blog post, the City of Lenexa has addressed this issue. The following blog post is simply meant to be a form of responsible disclosure and a break down of the events as they unfolded. If you are a resident of the City of Lenexa, and you haven’t been already contacted by the city, it is advised that you change any entry codes for your buildings and gates that you may have rendered to the city immediately.

Introduction

I’ve spent the better part of the past two years digging around public GIS datasets. GIS, standing for Geographic Information System, is basically a Google Map on steroids.

Local, State, and Federal governments have utilized this powerful tool since its inception; its a convenient way to store, manage, and view information about your community. Tracking things like zoning, roads, easements, and property ownership are crucial to keeping an area organized and managed properly.

A lot of larger cities have public web maps you can view right now. My hometown for example, has voting ward maps, zoning maps, and even one to see what day your trash will be picked up. This is done as a convenience service to the residents of these areas.

The Hidden Danger

The public web maps that these organizations provide are, in most cases, getting their information from a backend ArcGIS server.

As you move around one of these public web maps, your browser is making GET requests to an ArcGIS server in the background.

This is what one of those requests looks like (This is not for the city of Lenexa and is just an example):

To break this specific request down:

services6.arcgis.com : This is the domain the ArcGIS service is on. In this case its an ArcGIS cloud host.
<random hex string> (redacted piece) : This points your browser to the exact server on the ArcGIS cloud host.
/arcgis/rest/services/ : This is the root directory of the FeatureServer that lists all the available services/datasets.
Trash_Service_Day : Name of the folder, dataset, or service.
FeatureServer/0 : This is the layer index identifier. This is just asking the server for a specific layer on this FeatureServer. In this case it is “0”.

The key part you should remember is the root endpoint:

https://services6.arcgis.com/<server identifier>/arcgis/rest/services/

This is essentially the front door to the server’s available datasets; public or private.

While some organizations, like the one in the example, host these services in the cloud, others host them on their own infrastructure or domains resulting in URLs that look like this:

https://gis.yourtown.org/arcgis/rest/services/

You might notice that a consistent detail across all ArcGIS servers is the presence of “/rest/services/” in the URL. This will come into play later.

So What Are You Getting At Here?

These servers are generally more open than intended. If you compare what datasets/layers are available to you on your city’s public web map versus whats available on their public ArcGIS server, you’ll often see a lot more stuff available to view.

Most of the time, you’ll find that this wasn’t done intentionally. Organizations have been using the “security through obscurity” mindset for a long time. The managers of these systems aren’t expecting someone to go poking around their ArcGIS endpoints so things often get overlooked.

This has resulted in me running into many datasets that shouldn’t be public:

A dataset tracking school children registered to walk to school with their full address, grade level, and the school they walk to.
Security camera and motion sensor location maps for a major city hall.
A dataset containing city residents who signed up to share their camera footage with the police; complete with their full name, address, email, phone number, and details about their camera system.

This is only scratching the surface of what these systems can expose.

Lenexa’s GIS Server

While looking around at many of the local GIS servers available to me, I found that the city of Lenexa’s wasn’t linked on their website like a lot of other cities. They did have public web maps on their planning page, but these led to an https://experience.arcgis.com/ domain which acts kind of like a middle man, making it more difficult to identify the underlying data source.

Since I couldn’t find this backend through my usual methods, I resorted to my favorite approach: Googling it lol.

I used a technique commonly referred to as “Google Dorking”, which involves using hidden search commands to uncover content that isn’t easily discoverable through normal searches.

Dorking is used by researchers from all walks of life but its pretty commonly used by security researchers to audit their hosted services and file servers. If Google’s webcrawlers can see your stuff, so can everyone else (including bad people)!

In this case, I utilized the following query in a Google Search:

“lenexa” inurl:rest/services

Because we know from earlier that ArcGIS servers always will be hosted on a server with “/rest/services/” in the URL string, we can target that in our Google Search to find hidden GIS services.

We can tighten our search further by adding “lenexa” in quotations, which will only show us results with the word “lenexa” in the content or title.

When combined, this search will show us more directed results.

Right away, I could see the city of Lenexa was hosting a GIS service at https://gis.lenexa.com/arcgis/rest/services/

The Discovery

Visiting this URL shows a few available folders for us to look through. It is at this point I started exploring the Fire folder out of curiosity.

This folder had a lot of interesting datasets to view, but the one that interested me the most was FireStructures.

Inside of this service, there were a lot of available layers. I expected to only see things like fire hydrants and lock box locations, but I noticed a layer titled “Entry Code – Above Ground Structure”. The name alone raised immediate concern.

If you open any of these layers, you can click “View in: ArcGIS Online Map Viewer” and view the dataset in its entirety and in your browser.

Right away, I started to see problems with this public dataset. This was a map containing entry codes for residential gates, neighborhoods, and commercial properties throughout Lenexa.

What I stumbled on wasn’t just a simple data leak, it was effectively a map of working keys. Anyone who accessed this dataset could’ve used the valid codes to enter residential properties, neighborhoods, apartment complexes, or even commercial properties without forcing entry, raising suspicion, or triggering alarms.

This creates opportunities for targeted crimes, like low-risk burglaries or vehicle thefts, and because the access appears legitimate, it can also make detection and investigation that much harder.

There might be some of you who read this and say, “hey, this is pretty buried; is this really that serious?”. And to that I say, absolutely!!!

We’re not talking about the opportunistic who is looking to steal your lawn mower; we’re talking about the people and gangs who are organized, careful, and informed. This was not a matter of if; this was 100% a matter of when it would be exploited.

If I search for “entry code” with the same method we used earlier on Google, Lenexa’s Entry Code layer is currently number 4 in my search results.

Even if this dataset was taken down, the risk doesn’t immediately disappear. Anyone who accessed it may have saved the information, and entry codes are often not rotated frequently enough.

Another thing to note is this dataset was available online for an unknown about of time. Earliest results on the WayBack Machine show the Fire folder as early as 2018.

Inside of the dataset, some codes have a “created on” and “updated on” field filled out, and the earliest date on any of those is 2020. To be clear, neither of those details prove for certain how long they’ve been exposed.

Getting This Fixed

I discovered this dataset in January 2026. Recognizing the severity, I immediately began attempting to contact the City of Lenexa through email. I chose email as my primary contact because I wanted to stay documented through this process.

I first contacted the city clerk on January 29th hoping they could forward my email to the necessary team:

This email was followed by no response or change to the dataset. I then used an email address I found on their various GIS servers: gisworkrequest@lenexa.com. I sent this email on March 2nd:

That email was also met with no response. I then decided to email the Information Technology Director, Jerry Swingle, and Assistant Director, Anthony Sitzes. The following email was send on April 2nd:

Again, this email was met with no response or acknowledgement. I continued tracking this dataset and noticed on April 27th it was still being used and added to.

At that point, I opted to contact one of our local news stations ( to be named later 🙂 ) and they managed to get the city of Lenexa’s attention to this matter. I am forever grateful for their help and swift response.

Conclusion

I didn’t walk into this wanting to make the city of Lenexa look bad; they aren’t the only ones who have made this mistake.

GIS platforms are powerful but often overlooked from a security perspective, and misconfigurations like this are more common than many people realize.

Lenexa was very fast to fix this problem once someone was able to break through. It was fixed within an hour and I can’t thank them enough for being immediately on top of it. That being said, I’m not thrilled that my attempts to report the issue went unanswered for several months.

Reflecting on all of this, I realize the power that seemingly random hobbies can have. I started GIS map surfing for fun; I had no idea it would encompass my interests in security research. I’m ecstatic that this seemingly random interest was able to be used to keep our local communities safe.

Until next time!

~Sn00py