Researcher finds exposed credentials and other serious flaws across UK government code ...

Chris Nesbitt-Smith scanned 349 UK public-sector repositories and found serious flaws in two-thirds, reporting more than 100 in all, Wired reported [1] .

A Planning Inspectorate credential left in Git history could have given read-write access to all its SharePoint sites, private staff OneDrive accounts and legally sensitive evidence libraries, according to the report [1] .

The Inspectorate said it detected the activity in August, fixed the exposure within 20 minutes of being told and found no evidence of a breach [1] .

A researcher who scanned 349 publicly available UK government and public-sector code repositories found serious security flaws in two-thirds of them, including exposed credentials, weak access controls and insecure default settings, Wired reported [1] . Chris Nesbitt-Smith, a UK technologist, reported more than 100 serious flaws to the bodies involved [1] .

Nesbitt-Smith told Wired he found many of the problems using consumer-grade AI models running on a laptop, and that they were basic, long-standing errors that routine IT health checks should have caught [1] .

The Planning Inspectorate case

The most serious example involved the Planning Inspectorate, which handles planning appeals and major infrastructure applications in England. It had accidentally committed a Microsoft Entra ID login to a public repository and did not fully remove it, so the credential stayed in the repository's Git history and still appeared valid, according to Wired's report [1] . Nesbitt-Smith said the access could have allowed reading and writing across all of the agency's SharePoint sites, employees' private OneDrive accounts and legally sensitive evidence libraries, the level of access Wired's headline calls "god-tier" [1] .

The Planning Inspectorate said its monitoring detected the researcher's activity in August, that it treated the report as a cyber incident and fixed the exposed credentials within 20 minutes, and that it found no evidence of a data breach [1] . No breach has been shown, though an exposed secret can be copied by anyone who finds it before it is revoked, including from mirrored copies of public repositories.

Open code under pressure

The findings land in a running UK argument over whether AI tools make public code too risky to publish. After NHS England moved to make most of its public GitHub repositories private this spring, citing AI-assisted code analysis [3] , the Government Digital Service and the Department for Science, Innovation and Technology issued guidance on May 14 saying code should stay open by default, provided teams meet a minimum standard first, including that "secrets are never committed to any repository" and that automated scanning is in place [2] . The flaws Nesbitt-Smith describes are the kind that standard is meant to catch.