Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
The UK government has been openly publishing its code, funded by public money, for nearly a decade due to transparency and cost efficiency. This practice is followed by the Department of Health and Social Care, the Home Office, local authorities, and more. However, funding cuts have led to neglect of technology maintenance and improvement.
Security researcher Chris Nesbitt-Smith discovered these flaws using AI models. Most concerning was the Planning Inspectorate, which handles land-use in England, failing to remove a login from a public GitHub repository. This exposed Microsoft Entra ID credentials, granting "god-tier" access to SharePoint sites, employee OneDrive accounts, and sensitive libraries containing legal hold evidence.
Nesbitt-Smith believes routine IT checks could have caught many of these issues. A spokesperson for the Planning Inspectorate acknowledged the vulnerability was detected immediately and fixed within 20 minutes, with no data breach. OpenUK CEO Amanda Brock emphasizes these issues stem from internal housekeeping mistakes, not open source security.
In two-thirds of the 349 public sector codebases he scanned, Nesbitt-Smith found vulnerabilities, including in the Department of Education's procurement and teacher services, and a Scottish government open data portal. The Planning Inspectorate and others have since addressed these problems. Some argue that public sector departments should stop publishing source code due to accelerated AI vulnerability discovery.
However, Nesbitt-Smith warns that closing repositories without fixing issues would be counterproductive, potentially drawing more attention from adversaries.
Written by urgent.news from Wired's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
