Widespread security lapses in UK government code expose sensitive data

A security researcher identified over 100 serious vulnerabilities across publicly accessible codebases belonging to various UK government bodies, highlighting issues stemming from inadequate cyber hygiene. The researcher, Chris Nesbitt-Smith of ControlPlane, noted that while he utilized Claude’s Opus and Sonnet AI models, many flaws could have been caught through standard IT health checks. In one critical instance involving the Planning Inspectorate, credentials granting extensive read and write access to all SharePoint sites and private OneDrive accounts—including HR records—were accidentally published to GitHub. Nesbitt-Smith stated this exposed access, which included sensitive evidence under legal hold, presented a significant risk of ransomware or data theft. The Planning Inspectorate confirmed its monitoring tools detected the activity in August and resolved the issue within 20 minutes, stating they have strengthened their processes. Amanda Brock, CEO of OpenUK, clarified that the Planning Inspectorate incident was a failure of internal process rather than an open-source security flaw. Nesbitt-Smith's scan covered 349 public sector codebases across 33 organizations, finding issues in departments like Education, including a service containing personal data and a Scottish Government portal allowing configuration changes. Amid these findings, the NHS reportedly directed teams to move away from open source code in May due to AI security concerns.