Unauthenticated /api/infrastructure serves nuclear weapons facility coordinates, ICBM sites, undersea cable routes and an IRAN_TARGETS layer to anyone

[tg12]

Summary

GET /api/infrastructure publicly exposes precise coordinates for nuclear weapons assembly facilities, underground enrichment bunkers, ICBM launch sites, and a layer explicitly named IRAN_TARGETS — with zero authentication, rate limiting, or access control. Every data layer is served to any anonymous HTTP client worldwide.

Evidence

File: src/lib/infrastructure.ts (served verbatim via src/app/api/infrastructure/route.ts)

Nuclear weapons facilities with GPS coordinates:

export const NUCLEAR_SITES = [
  { id: 'nuke-2', name: 'Pantex Plant', lat: 35.32, lon: -101.56, type: 'weapons',
    description: 'Primary US nuclear weapons assembly' },
  { id: 'nuke-3', name: 'Y-12 Oak Ridge', lat: 35.98, lon: -84.25, type: 'weapons' },
  { id: 'nuke-4', name: 'Sarov (Arzamas-16)', lat: 54.93, lon: 43.32, type: 'weapons',
    description: 'Russian nuclear weapons design' },
  { id: 'nuke-9', name: 'Natanz', lat: 33.72, lon: 51.72, risk: 'critical' },
  { id: 'nuke-10', name: 'Fordow', lat: 34.88, lon: 51.00, risk: 'critical',
    description: 'Underground enrichment facility' },
  { id: 'nuke-13', name: 'Yongbyon', lat: 39.80, lon: 125.75, risk: 'critical' },
  { id: 'nuke-14', name: 'Punggye-ri', lat: 41.28, lon: 129.08, risk: 'critical',
    description: 'Nuclear test site' },
];

ICBM launch sites:

export const SPACEPORTS = [
  { id: 'space-14', name: 'Sohae', type: 'ICBM', lat: 39.66, lon: 124.70,
    country: 'North Korea', risk: 'critical' },
  { id: 'space-15', name: 'Semnan', type: 'ICBM', lat: 35.23, lon: 53.92,
    country: 'Iran', risk: 'high' },
];

Undersea cable routes with segment waypoints — full routing for SEA-ME-WE 3, FLAG Europe-Asia, MAREA (Microsoft/Facebook), TAT-14, and others:

export const UNDERSEA_CABLES = [
  { id: 'cable-5', name: 'MAREA', capacity: '200 Tbps', owners: 'Microsoft, Facebook, Telxius',
    points: [[39.45, -74.45], [43.46, -3.80]] },
];

And critically, a layer named IRAN_TARGETS:

import { IRAN_TARGETS } from '@/lib/infrastructure';
// Served at: GET /api/infrastructure?layer=iran
return NextResponse.json({ data: IRAN_TARGETS, layer: 'iran' });

All layers are also returned together at GET /api/infrastructure (no layer param needed) with no auth check.

Why this matters

This is a public, machine-readable API that aggregates targeting-adjacent geospatial data with zero access controls:

• Nuclear weapons assembly sites in the US, Russia, UK, France, Pakistan, India.
• Specific coordinates of known hardened/underground facilities (Fordow, Sarov).
• Active ICBM test sites for North Korea and Iran flagged with risk: "critical".
• Routes for undersea internet cables carrying hundreds of terabits of global traffic.
• An explicitly named IRAN_TARGETS geospatial dataset.

While individual coordinates are discoverable via open sources, packaging them into a structured, authenticated-free JSON API with risk classification and type: "weapons" labels crosses into OSINT weaponisation territory.

Attack or failure scenario

# Enumerate all nuclear weapons facilities with coordinates
curl https://feed.xdc.network/api/infrastructure?layer=nuclear | jq '.data[] | select(.type == "weapons")'

# Get the IRAN_TARGETS dataset
curl https://feed.xdc.network/api/infrastructure?layer=iran

Root cause

Infrastructure data was added as a map layer feature without any access controls being designed for it. The entire IRAN_TARGETS sub-layer indicates this data was curated for a specific operational scenario, not merely for educational visualization.

Recommended fix

1. Immediately remove the IRAN_TARGETS layer entirely — there is no legitimate public-facing justification for a dataset named this.
2. Evaluate whether any of the nuclear weapons facility data should be served publicly at all, even if it's open-source.
3. If the data is retained for visualization, require authentication and log all access.
4. Remove type: "weapons" classification and risk: "critical" labels from the public API response.

Acceptance criteria

• IRAN_TARGETS layer removed from the codebase entirely.
• /api/infrastructure requires authentication.
• type: "weapons" and targeting-related metadata removed from public responses.
• Access to remaining infrastructure data logged.

Suggested labels

security, bug

Priority

P0

Severity

Critical — unauthenticated public API packages nuclear weapons facility coordinates and ICBM sites into a machine-readable targeting dataset.

Confidence

Confirmed — data is in src/lib/infrastructure.ts and served unauthenticated via /api/infrastructure.

---

This issue was filed as part of the AI Slop Intelligence Dashboard Awareness Program.
Repo under review: https://github.com/OpenScanAI/GlobeNewsLive
Programme: https://labs.jamessawyer.co.uk/ai-slop-intelligence-dashboards/