Researcher finds exposed credentials and flaws in UK public sector code on GitHub

A security researcher scanned 349 codebases that UK public bodies publish openly and found vulnerabilities in about two-thirds of them, according to WIRED. The worst case was at the Planning Inspectorate. A login the agency had committed to GitHub by accident gave read and write access to its SharePoint sites and its employees' private OneDrive accounts.

The researcher is Chris Nesbitt-Smith of the security firm ControlPlane. He used Anthropic's Claude Opus and Sonnet models on a laptop. He says the tools were nothing special, and that a routine IT health check could have caught many of the problems. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," he told WIRED. "It's all daft stuff."

A login that was never fully removed

For about a decade the UK government has published the code it pays for by default. It does this for transparency, and because reusable code saves money. The practice covers the Department of Health and Social Care, the Home Office and local authorities, among others. WIRED reports that tight budgets have left departments neglecting maintenance of their technology.

The Planning Inspectorate handles land-use matters across England. It accidentally committed credentials for its Microsoft Entra ID environment to a public GitHub repository and did not fully remove them. Nesbitt-Smith says the credentials gave very wide access and apparently did not expire. He told WIRED this combination "made it particularly dangerous for them."

According to Nesbitt-Smith, the access was "god-tier". It covered all SharePoint sites and staff OneDrive accounts, including HR records. It also reached libraries that hold evidence under legal hold for statutory planning inquiries and appeals. "The option for ransomwaring them, for encrypting all the data, or just stealing all the data, was abundantly there," he said.

A Planning Inspectorate spokesperson told WIRED that its monitoring tools picked up Nesbitt-Smith's activity in August as it happened. The agency says it was already treating the activity as a cyber incident when ControlPlane got in touch. It says it fixed the vulnerability within 20 minutes of the report and confirmed that no data breach had occurred. "We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher's work and for alerting us to it," the spokesperson said.

Education services and a Scottish data portal

The scan covered 33 organisations. Nesbitt-Smith reported several vulnerabilities in Department for Education code. They included a procurement service used by schools and a teacher application service that holds personal details, qualifications, employment history and identity documents. Another was in England's main register of government-funded training providers and apprenticeships. He also found a flaw in a Scottish Government open data portal: any visitor could read administrative account information and change the site's configuration. WIRED reports that the organisations have since fixed the issues.

Amanda Brock, chief executive of the industry nonprofit OpenUK, said the Planning Inspectorate case "isn't about open source but internal housekeeping when using public tools." She added: "That data was exposed because of a failure not to follow good process. That's not an open source security issue."

The argument over closing the code

AI tools now find vulnerabilities faster, and some have argued that public bodies should stop publishing source code as a result. WIRED reports that the NHS told its technology teams in May to move away from open source code because of security concerns about AI models.

Nesbitt-Smith says closing repositories without first fixing what is in them would be the "worst case scenario". Researchers like him could no longer find the problems. An adversary has probably already mirrored the repositories and would keep its copies. "Unless you're going to go and fix all of the problems, if anything, you're probably drawing more attention to it by closing it," he said, "because you're like, 'Here be dragons over this space. Don't look here though, please.'"

Central government guidance takes a similar position. In May 2026 the Government Digital Service and the Department for Science, Innovation and Technology published guidance on AI, open code and vulnerability risk. It keeps openness as the default. It states that "making code private is not an appropriate mitigation for lack of ownership, patching capability, or operational assurance." It notes that "popular repositories are often mirrored or forked" and that secrets must never be committed "to any repository (public or private)." It also warns that AI shortens the window between discovery and exploitation. It recommends set patch timelines, automated dependency management, and using the same AI tools for defensive review.

What it means for work

One person with a laptop and consumer AI models reviewed hundreds of government codebases. Until recently, that kind of review took a dedicated team. Attackers can now do the same cheaply, so the cost falls on whoever runs the systems. Public sector IT teams need to scan for leaked secrets, rotate and expire credentials, and patch on a fixed schedule. Most of this is basic housekeeping that budget pressure has pushed aside. The findings also suggest that openness was not the main weakness. Basic process was. Teams need to remove secrets properly and limit what a single credential can do. It is still unclear whether departments will get the people and money for this, and whether some will close their repositories instead.