A review of public UK government code uncovered more than 100 serious vulnerabilities, many of them issues that a routine technology health check might have caught. The findings included a login that could have granted broad access to government files, as well as weaknesses in services used by schools and public agencies.
A forgotten login carried broad access
The most serious issue involved the Planning Inspectorate, which handles land-use matters across England. A login had been accidentally committed to a public GitHub repository and was not fully removed. The credentials appeared not to expire and could have provided wide access through Microsoft Entra ID.
According to researcher Chris Nesbitt-Smith, that access would have reached SharePoint sites and private employee OneDrive accounts, including HR records. It also covered libraries holding evidence under legal hold for planning inquiries and appeals. The exposed permissions could have enabled someone to steal or encrypt data.
The Planning Inspectorate said its cyber monitoring tools detected the researcher’s activity in August. It said the vulnerability was identified and fixed within 20 minutes of the report, and that its review found no data breach. The agency also said it had strengthened systems and processes to reduce the chance of a repeat.
Weaknesses appeared across public services
Nesbitt-Smith, a security researcher at ControlPlane, examined 349 public sector codebases across 33 organizations. He found vulnerabilities in around two-thirds of them. Several were in Department of Education code, including services for school procurement and teacher applications.
The teacher application service contained personal details, qualifications, employment history and identity documents. A separate vulnerability affected England’s main register of government-funded training providers and apprenticeships. A Scottish Government open data portal also had a flaw that could have let visitors read administrative account information and change site configuration. The organizations addressed the reported issues.
The review’s scale points to a maintenance challenge: publishing code makes it available for reuse and scrutiny, but the code and systems around it still need regular attention. Nesbitt-Smith said funding squeezes have left departments neglecting maintenance and improvement of their technology estate.
Open code and security are not the same issue
The UK government has published code produced with public money openly for around a decade, citing transparency and the cost savings that come from reuse. The vulnerabilities have added to arguments that public sector departments should stop publishing source code now that AI has accelerated the discovery of flaws.
But the Planning Inspectorate incident involved an exposed login in a public repository, rather than a flaw inherent to open-source software. Amanda Brock, chief executive officer of OpenUK, described it as a failure of internal housekeeping and good process. Her distinction matters: closing repositories would not itself remove credentials that have already been exposed or repair weaknesses in the underlying systems.
Nesbitt-Smith said he used Claude’s Opus and Sonnet AI models on a laptop, and characterized many of the issues as discoverable through ordinary checks. His account suggests that AI can help surface problems, while the basic work of managing credentials, reviewing code and maintaining systems remains central.
Closing repositories may hide problems
Nesbitt-Smith warned that removing public access without fixing the underlying issues could make the situation worse. Researchers would have less ability to find vulnerabilities, while an adversary might already have copied the repositories and retained access to them.
For agencies, the practical choice is not simply whether code is visible. The reported incidents point to the need to address the flaws, remove exposed access, and keep systems and processes under review. Public visibility can help others identify problems, but it does not replace the maintenance needed to prevent them.