Fast Facts
-
Over 100 serious vulnerabilities were found across UK public-sector code, with issues in roughly two-thirds of the 349 codebases scanned.
-
Basic security lapses created major risks: exposed credentials at the Planning Inspectorate could have opened access to sensitive SharePoint, OneDrive and legal records. The agency says it fixed the issue quickly and confirmed no data breach.
-
AI helped uncover the flaws—but they weren’t sophisticated. Researcher Chris Nesbitt-Smith says many could have been caught through routine security checks and better maintenance.
-
Making code private isn’t a fix. Researchers warn that hiding vulnerable code without repairing it may make problems harder to find, while attackers could already have copies.
Open code brings value — and risk
For about a decade, UK government agencies have published code developed with public funds. The practice supports transparency and lets teams reuse software, which can save money. However, public code also needs regular upkeep.
A security researcher found more than 100 serious vulnerabilities across government code. In roughly two-thirds of 349 codebases from 33 organizations, the researcher found security issues. Consumer-grade AI tools helped identify them, but many flaws could also have surfaced in routine checks.
One exposed credential carried broad access
The most serious flaw involved a login credential that the Planning Inspectorate had accidentally posted to GitHub. It could have opened access to SharePoint sites, employee OneDrive accounts and sensitive records. That breadth made the exposure especially dangerous.
The agency said its monitoring tools detected the researcher’s activity. It fixed the flaw within 20 minutes of receiving a report and found no evidence of a data breach. It also said it strengthened its systems and processes.
Fix the weaknesses, not just the visibility
Other findings affected services tied to schools, teacher applications, training providers and a Scottish Government data portal. The organizations have since addressed the reported issues.
Some public agencies have considered limiting open-source publication as AI speeds up flaw discovery. Yet closing repositories without repairing weaknesses could hide problems rather than solve them. Open code can aid oversight and reuse; sound maintenance, careful credential handling and prompt fixes make that approach safer.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
AITechV1
