Researcher finds serious flaws in public UK government code
Original title: Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A Planning Inspectorate GitHub commit left Microsoft Entra ID credentials that could have reached SharePoint, OneDrive and legal-hold files.
ControlPlane researcher Chris Nesbitt-Smith reported more than 100 serious issues in publicly published UK public-sector code, found with consumer Claude Opus and Sonnet models. The most serious case was Planning Inspectorate login credentials left in a public GitHub repository, which he said would have allowed broad read and write access to SharePoint, private OneDrive accounts and legal-hold evidence libraries. The agency says monitoring detected the activity in August, the issue was fixed within 20 minutes of the report, and no data breach occurred. Issues in Department of Education services and a Scottish Government open data portal have also been dealt with, he said.
Unconfirmed: The researcher describes what the credentials could have accessed; the Planning Inspectorate says no breach occurred.
- He reported flaws in about two-thirds of 349 codebases across 33 organizations.
- The Planning Inspectorate said it verified that no data breach occurred.
- Department of Education findings covered a school procurement service and a teacher application service.
- A Scottish Government portal flaw could have exposed admin account data and site configuration.
- The NHS reportedly told teams in May to move away from open source over AI concerns.
Impact: Potential broad access to government files and personal records
| Product | Affected |
|---|---|
| Planning Inspectorate Microsoft Entra ID credentials in public GitHub code | — |
- 1.Review public repositories for committed credentials and remove exposed logins.
- 2.Treat published government code as needing routine maintenance, not just transparency.
- Vendors
- Microsoft
- Countries
- United Kingdom
- AI models
- Claude OpusClaude Sonnet
From the original article
3 min read at wired.com
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
By Isabella Ward · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.