The DOGE website is seemingly so insecure it can be edited by anyone

According to researchers, anyone who knows where to look can spray digital graffiti on the (DOGE) website. Two web development experts said the site doesn’t seem to be hosted on government servers and that the database it pulls from can be modified by those who locate it. At the time of writing, a message reading “these ‘experts’ left their database open – roro” is still visible on the DOGE site.

DOGE chief and President Trump consigliere Elon Musk on Tuesday that his team would be as transparent as possible, with updates on its actions shared to an X account and website. As notes, the DOGE website was pretty much blank at the time. Since then, it’s been hurriedly assembled to show a feed of posts from the entity’s X account, along with details about the federal workforce.

The researchers told 404 that the site appeared to be built on Cloudflare Pages instead of government servers. After looking at the site’s architecture and API endpoints, one was able to locate the database containing stats on government employees. They made changes to database entries that were reflected on the DOGE website.

It’s not the first time that a federal website operating under the Trump administration has appeared to have been slapped together. Just this week, the waste.gov was locked after it was reported that the site displayed a dummy WordPress page, complete with placeholder text.

DOGE does acknowledge that there are possible issues with its web presence. “This is DOGE’s effort to create a comprehensive, government-wide org chart,” a footnote on the DOGE website reads. “This is an enormous effort, and there are likely some errors or omissions. We will continue to strive for maximum accuracy over time.”

However, it doesn’t exactly inspire confidence that a team tasked with making sweeping cuts to government spending and allegedly into federal systems that contain on federal employees and citizens can’t secure its own website. Perhaps the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency wasn’t the wisest idea.