In a remote part of Afghanistan — a US military outpost. In the middle of Niger the outlines of an expanded base and airstrip. In Syria, exercise routines and possible patrolling routes on a base where American special forces trained. By design, these secretive locations are supposed to be difficult to spot. But a heat map posted online by Strava, a company that tracks people’s exercise routes, has inadvertently put these places on public display for all the world to see. Many of the military bases are already well known, like Bagram and Kandahar air fields in Afghanistan. And the material we’re revealing here doesn’t go beyond anything that isn’t already available on the open web. But Strava’s platform has drawn attention in a new way to the activity of military personnel in far flung outposts and has laid bare some loopholes in the security of military bases. How did this happen? Strava is an app and social network that connects with devices like Fitbit and is used to log workouts. It’s popular with U.S. soldiers and others stationed abroad and the Pentagon has distributed several thousand of them to its personnel. They use it to track their exercise routines and everyday activities like walks or patrols. But it also tracks users’ locations, and in November 2017 the company updated a map showing over 1 billion activities and 3 trillion GPS points. Twenty-year-old international security student Nathan Ruser was the first to point out how Strava’s map could compromise operational security. The map alone doesn’t show the complete picture and its satellite images are outdated, but it does tell you where to look. So by combining it with recent satellite imagery and other reporting, we get a clearer sense of what’s happening on the ground. Take this new U.S. Air Force Base in Sarrin, Syria. The map shows workouts are walking routes — activities that provide a clear blueprint of the base and by tracing the lines, we can follow soldiers to a newly set up helicopter pad. Here’s what else we found. A new compound at a French military site in Mali, Strava highlighted the camp in the first place and no other mapping platforms had marked the site. These U.S. forward operating bases in Afghanistan. The location of a U.S. drone base under construction in Agadez, Niger, and various military facilities in Djibouti, where the U.S. is fighting extremist groups in the Horn of Africa. And there are some mysterious sites that we can’t yet identify. An area in the middle of the Nigerian desert. Two remote locations surrounded by sand barriers in Yemen And here’s an unusual activity in the desert in Mauritania that led us to a suspected military site, including an extended airstrip nearby. Strava also allows users to share photos and workout routes. It’s basically Facebook for athletes. This allows everyone with an account to see who is working out where. For example, the “King of the Camp” run at a U.S. military base in Iraq, or the “Embassy River Wall Segment” in Baghdad’s green zone, or the perimeter base run where more than 15 individuals stationed at a U.S. military base challenge themselves. We found photos posted by users from inside military bases and the online profiles of several U.S. service members stationed at one base near Mosul in Iraq. A Pentagon spokeswoman said that this data release emphasized the need for personnel to have situational awareness. And it’s assessing if any additional training or guidance is required. There are some areas where people presumably are not allowed to bring their cellphones. User activity at C.I.A. and N.S.A. headquarters, for instance, can be seen around the perimeters, but not beyond certain points inside the structure. But out in the remote corners of the world where the U.S. military is operating, there’s plenty to see.