A researcher found security holes in two-thirds of UK public code

A security researcher scanned 349 pieces of publicly shared UK government software and found flaws in about two-thirds of them. The worst case was a leaked login at the Planning Inspectorate that could have opened HR records and legal evidence files. The agency says it fixed the problem within 20 minutes of the report and that no data breach occurred.

What was found

Chris Nesbitt-Smith, a security researcher at ControlPlane, looked through code that government bodies have published online. The code came from 33 organizations. UK government has defaulted to publishing code paid for with public money for around a decade. The aim is openness and lower costs, because others can reuse the work.

He used consumer-grade Claude AI models on a laptop. He says many of the problems could have been caught by a routine IT health check. In his words, "It's all daft stuff."

The most serious case

The Planning Inspectorate handles land-use matters across England. It accidentally posted a login to GitHub, a public site where programmers share code, and did not fully remove it. Nesbitt-Smith says the login gave wide access and seemingly did not expire.

According to him, it would have given read and write access to all SharePoint sites and private employee OneDrive accounts. That includes HR records and libraries holding evidence under legal hold for planning inquiries and appeals. He says ransomware or data theft was an open option.

The agency says its monitoring tools detected his activity in August and that it was already treating the matter as a cyber incident when ControlPlane made contact. It says it has strengthened its systems and processes.

Other findings

• Department of Education: a schools procurement service, a teacher application service holding personal details and identity documents, and the register of training providers.
• Scottish Government: an open data portal where any visitor could read administrative account information and change site configuration.

The organizations have since dealt with the issues.

Should code stay public?

Some argue departments should stop publishing code now that AI speeds up the hunt for weaknesses. The NHS reportedly ordered technology teams to move away from open source code in May. Nesbitt-Smith calls closing code without fixing the problems the worst case, because it blocks researchers and an attacker may already hold copies.

Amanda Brock of the nonprofit group OpenUK says the Planning Inspectorate case was a failure to follow good process, not an open source security issue.

What to do

The lesson for any business is basic housekeeping. Passwords and access keys should not sit in code or shared places. Check for them, and make sure any that slip out can be shut off quickly.