A security researcher has uncovered more than 100 serious vulnerabilities in publicly accessible UK government code, exposing sensitive information through lapses in basic digital security practices. Chris Nesbitt-Smith, a security researcher at ControlPlane, identified the flaws using consumer-grade AI models running on a laptop, demonstrating that many issues could have been caught through routine IT health checks. The UK government has made its publicly funded code available for nearly a decade in the name of transparency and cost efficiency, but funding constraints have left agencies struggling to maintain and improve their technology infrastructure.
Nesbitt-Smith discovered vulnerabilities in roughly two-thirds of 349 public sector codebases spanning 33 organizations. The most severe case involved the Planning Inspectorate, which handles land-use decisions throughout England, where login credentials accidentally published to GitHub would have granted complete Microsoft Entra ID access with what Nesbitt-Smith described as "god-tier" read and write permissions to all SharePoint sites and private employee OneDrive accounts, including HR records. The exposed credentials also provided entry to sensitive libraries protecting evidence under legal hold for statutory planning inquiries and appeals. Multiple vulnerabilities appeared in Department of Education code, including systems containing teachers' personal details, qualifications, employment histories, and identity documents, as well as a procurement service used by schools and England's primary register of government-funded training providers and apprenticeships. A Scottish Government open data portal vulnerability would have allowed any visitor to read administrative account information and alter site configuration.
According to Nesbitt-Smith, the issues he found weren't sophisticated attacks that require advanced capabilities. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," he told WIRED. "It's all daft stuff." The Planning Inspectorate confirmed its cyber monitoring tools immediately detected Nesbitt-Smith's activity in August and that it had already been handling the situation as a cyber incident when ControlPlane made contact, identifying and fixing the vulnerability within 20 minutes of the report and verifying no data breach occurred. Amanda Brock, chief executive officer of nonprofit industry group OpenUK, noted the Planning Inspectorate issue wasn't about open source but rather "internal housekeeping when using public tools," adding that the data was exposed "because of a failure not to follow good process."
Recent debates have emerged over whether public sector departments should stop publishing source code openly now that AI has accelerated vulnerability discovery, with the NHS reportedly ordering technology teams to transition away from open source code in May amid security concerns about AI's impact. Nesbitt-Smith argues that closing repositories without immediately fixing underlying problems would be the worst outcome, as it prevents researchers like him from finding vulnerabilities while adversaries have likely already mirrored these repositories and will retain access to them. "Unless you're going to go and fix all of the problems, if anything, you're probably drawing more attention to it by closing it," Nesbitt-Smith said, "because you're like, 'Here be dragons over this space. Don't look here though, please.'" The affected organizations have since addressed the identified issues. Transparency advocates face a delicate calculation between visibility and exposure, particularly as automation transforms both offensive and defensive capabilities at similar rates.