A security researcher has identified over 100 serious flaws in publicly available UK government code, leaving sensitive data exposed due to poor maintenance.
The UK government has published its publicly funded software openly for roughly a decade to ensure transparency and enable code reuse. This practice covers the Department of Health and Social Care, the Home Office, and various local authorities.
Funding pressures have left departments neglecting the upkeep of their technology estates. ControlPlane security researcher Chris Nesbitt-Smith located the vulnerabilities using Claude’s Opus and Sonnet AI models on a standard laptop. He notes that many issues could have been spotted during a routine IT health check. “None of this is the level of sophistication that general media is worried about in terms of cyber attacks,” Nesbitt-Smith told WIRED. “It’s all daft stuff.”
The most severe case involved the Planning Inspectorate, which manages land-use matters across England. The agency failed to remove a login after accidentally committing it to the public GitHub repository. The credentials granted wide access and did not expire. This combination of accidental publication and persistent access “made it particularly dangerous for them,” according to the researcher.
Access to the complete Microsoft Entra ID would have provided “god-tier” read and write permissions to all SharePoint sites and private employee OneDrive accounts. This included HR records. The security researcher also noted access to sensitive libraries safeguarding evidence under legal hold for statutory planning inquiries and appeals. “The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there,” Nesbitt-Smith says.
A spokesperson for the Planning Inspectorate told WIRED that cyber monitoring tools detected Nesbitt-Smith’s activity in August. The agency was already treating the situation as a cyber incident when ControlPlane made contact. They identified and fixed the vulnerability within 20 minutes of the report and confirmed no data breach occurred. “We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher’s work and for alerting us to it,” they told WIRED.
Amanda Brock, chief executive officer of the nonprofit industry group OpenUK, stated the Planning Inspectorate issue “isn’t about open source but internal housekeeping when using public tools.” She added that the data was exposed because of a failure not to follow good process. “That’s not an open source security issue.”
Nesbitt-Smith found vulnerabilities in around two-thirds of the 349 public sector codebases scanned across 33 organisations. Several issues appeared in the Department of Education’s code, including a procurement service used by schools, a teacher application service containing personal details, qualifications, employment history and identity documents, and England’s main register of government-funded training providers and apprenticeships. He also found a flaw in a Scottish Government open data portal that would have allowed any visitor to read administrative account information and change site configuration. The organisations have since dealt with the issues.
Debate has recently emerged regarding whether public sector departments should stop publishing source code openly, especially as AI accelerates vulnerability discovery. The NHS reportedly ordered technology teams to transition away from open source code in May amid security concerns about the impact of AI models.
Nesbitt-Smith describes this approach as the “worst case scenario” if the underlying issues are not fixed immediately. It prevents researchers like him from finding them and likely means an adversary has already mirrored these repositories to maintain access. “Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it,” Nesbitt-Smith says. “because you’re like, ‘Here be dragons over this space. Don’t look here though, please.'”
What it means
For government departments, the immediate priority is fixing the specific code flaws rather than removing the repositories entirely. Closing access without repairs highlights the problems and may encourage attackers to target the hidden vulnerabilities.
