Gazeta Lodz - UK Government Security Flaws Expose 'God-Tier' Access to Sensitive Data

A security researcher has identified more than 100 serious vulnerabilities in publicly available UK government code, raising concerns about the safety of sensitive data across multiple departments. The discovery underscores a growing tension between the government’s long-standing commitment to open-source transparency and the deteriorating state of its digital maintenance due to budget constraints.

Chris Nesbitt-Smith, a security researcher at ControlPlane, conducted the audit using consumer-grade AI models on a laptop. He found that many of the issues could have been detected through routine IT health checks, describing the vulnerabilities as "daft stuff" rather than sophisticated cyber attacks typically feared by the general public.

The most critical finding involved the Planning Inspectorate, the body responsible for land-use matters in England. The agency had accidentally committed login credentials to a public GitHub repository and failed to remove them. These credentials provided access to the complete Microsoft Entra ID system, granting what Nesbitt-Smith described as "god-tier" read and write access to all SharePoint sites and private employee OneDrive accounts.

This access extended to human resources records and sensitive libraries safeguarding evidence under legal hold for statutory planning inquiries and appeals. Nesbitt-Smith noted that the credentials appeared not to expire, compounding the danger. He stated that the situation offered ample opportunity for ransomware attacks, data encryption, or theft.

A spokesperson for the Planning Inspectorate confirmed that its cyber monitoring tools detected Nesbitt-Smith’s activity in August. The agency reported that it was already handling the event as a cyber incident when ControlPlane made contact. The vulnerability was identified and fixed within 20 minutes of the report, and the agency verified that no data breach occurred. They stated they had reviewed and strengthened their systems to prevent recurrence.

Amanda Brock, chief executive of the nonprofit industry group OpenUK, argued that the Planning Inspectorate issue was not a failure of open-source software but rather a lapse in internal housekeeping when using public tools. "That data was exposed because of a failure not to follow good process," she said, emphasizing that this is not an inherent security issue with open source.

Nesbitt-Smith’s scan covered 349 public sector codebases across 33 organizations, finding vulnerabilities in approximately two-thirds of them. Other affected entities included the Department of Education and the Scottish Government. In the Department of Education, flaws were found in a procurement service used by schools, a teacher application service containing personal details and identity documents, and England’s main register of government-funded training providers.

A vulnerability in the Scottish Government’s open data portal would have allowed any visitor to read administrative account information and change site configuration. All identified organizations have since addressed these issues.

The findings come amid ongoing debate about whether public sector departments should stop publishing source code, particularly as artificial intelligence accelerates the discovery of vulnerabilities. In May, the National Health Service reportedly ordered technology teams to transition away from open-source code due to security concerns regarding AI models.

Nesbitt-Smith warned that closing repositories without fixing underlying issues would be the "worst case scenario." He argued that this approach prevents researchers from identifying problems and likely fails to stop adversaries who have already mirrored the repositories. "Unless you’re going to go and fix all of the problems, if anything, you’re probably drawing more attention to it by closing it," he said. "Because you’re like, 'Here be dragons over this space. Don’t look here though, please.'"

The UK government has generally defaulted to openly publishing code produced with public money for around a decade, citing transparency and the cost-efficiency of reusability. However, Nesbitt-Smith noted that funding squeezes have left departments neglecting the maintenance and improvement of their technology estates.

A.Walczak--GL