Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A security researcher discovered over 100 serious vulnerabilities in UK government code repositories, putting sensitive information at risk due to poor cyber hygiene.
The UK government has openly published code produced with public money for about a decade, promoting transparency and cost efficiency. However, funding constraints have led departments to neglect technology maintenance, creating significant security risks. ControlPlane researcher Chris Nesbitt-Smith found these vulnerabilities using consumer-grade AI models on a laptop, emphasizing that many issues could have been caught through routine IT checks.
Critical Security Exposure
The most serious vulnerability involved the Planning Inspectorate, which accidentally committed login credentials to a public GitHub repository. These credentials provided 'god-tier' read and write access to all SharePoint sites and private employee OneDrive accounts, including HR records and legally protected evidence.
The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there.
Systemic Issues
The Planning Inspectorate detected the researcher's activity in August and fixed the vulnerability within 20 minutes, confirming no data breach occurred. However, similar issues were found across approximately two-thirds of 349 public sector codebases across 33 organizations. The Department of Education's code contained vulnerabilities affecting services handling personal data of teachers and apprenticeship providers.
Amanda Brock, CEO of OpenUK, clarified that the issue stems from internal process failures rather than open source security problems. "That data was exposed because of a failure not to follow good process," she stated.
Policy Shift
The discovery has intensified debates about public sector code transparency. The NHS reportedly ordered teams to transition away from open source code in May due to AI-related security concerns. This raises questions about how the government will balance transparency with security in an era of accelerated vulnerability discovery.
Related
