A recent security audit has revealed more than 100 serious vulnerabilities spread across publicly available UK government code repositories. The findings highlight significant cyber hygiene issues resulting from underfunded technology estates and neglected digital maintenance across multiple public sector departments.
For approximately a decade, the UK government has defaulted to openly publishing software code produced with public funds. This transparency aims to cut costs through code reuse and improve public sector efficiency. However, recent funding constraints have left various government bodies unable to properly maintain and secure their digital infrastructure. ControlPlane security researcher Chris Nesbitt-Smith uncovered these security flaws after scanning public repositories using consumer-grade artificial intelligence models, specifically Claude's Opus and Sonnet variants running on a standard laptop.
Among the departments affected were the Department of Health and Social Care, the Home Office, the Department of Education, and various local authorities. In one of the most severe cases discovered by Nesbitt-Smith, the Planning Inspectorate accidentally committed active login credentials to a public GitHub repository. These credentials granted complete Microsoft Entra ID access, providing what the researcher described as "god-tier" read and write capabilities across all SharePoint sites, private employee OneDrive accounts, human resources records, and sensitive legal evidence libraries.
Key takeaways
- A security researcher found over 100 serious vulnerabilities in UK government public code.
- Flaws stemmed from poor internal housekeeping rather than inherent open-source issues.
- A Planning Inspectorate leak exposed complete Microsoft Entra ID read and write access.
- The affected agencies addressed the reported security issues after being alerted.
A spokesperson for the Planning Inspectorate stated that cyber monitoring tools immediately detected the researcher's activity in August. The agency confirmed that it fixed the vulnerability within 20 minutes of receiving the report and verified that no actual data breach took place. Amanda Brock, chief executive officer of nonprofit industry group OpenUK, emphasized that the incident stemmed from internal procedural failures rather than a flaw in open-source methodology itself.
Additional security gaps were identified in the Department of Education’s code, impacting school procurement systems and teacher application portals containing personal details, qualifications, and identity documents. A Scottish Government open data portal also contained a flaw that would have allowed visitors to read administrative account details and modify site configurations. All of the targeted organizations have since addressed the specific vulnerabilities identified in the scan.
The discoveries have triggered broader debates regarding whether public sector agencies should continue publishing source code openly, especially as automated tools and artificial intelligence accelerate vulnerability discovery. The NHS reportedly directed its technology teams to transition away from open source code earlier in May amid similar security concerns. However, Nesbitt-Smith warns that simply hiding repositories without resolving underlying architectural problems creates a false sense of security, as malicious actors may have already mirrored the code.
Comments