How neglected maintenance left UK government sites wide open

Scan finds flaws in nearly two-thirds of UK public sector codebases

Chris Nesbitt-Smith, a security researcher at ControlPlane, scanned 349 public sector codebases across 33 UK government agencies. He found vulnerabilities in 233 of them—nearly two-thirds. The flaws weren’t buried deep. A laptop and off-the-shelf AI tools like Claude’s Opus surfaced them in hours.

The worst lapse came from the Planning Inspectorate. It committed Microsoft Entra ID credentials to a public GitHub repository and never fully scrubbed them. Those credentials unlocked everything: all SharePoint sites, private OneDrive accounts—including HR records—and libraries holding legally protected evidence for planning inquiries. The Inspectorate caught Nesbitt-Smith’s test access in August and revoked the credentials within 20 minutes. It later confirmed no data had been stolen.

Education and Scottish agencies patched flaws after warnings

The Department of Education’s procurement and teacher application services were among the exposed systems. So was England’s register of government-funded training providers and apprenticeships. Nesbitt-Smith also flagged a Scottish Government open data portal that let visitors read—and alter—administrative accounts. All three agencies patched the holes after he reported them.

These breaches did not happen in a vacuum. For ten years, UK government policy has mandated that publicly funded code be published openly. The goal was transparency and reuse. But budgets shrank, maintenance slipped, and basic checks were skipped. Amanda Brock, CEO of OpenUK, put it bluntly: the Planning Inspectorate’s mistake was a process failure, not an open-source problem. A routine IT audit should have caught the exposed credentials long before an outsider did.

NHS shifts away from open source as experts warn of bigger risks

The NHS reportedly ordered its teams in May to stop using open source code. The reason: AI tools can now scan public repositories and surface vulnerabilities faster than agencies can fix them. But experts say the order misses the point. "Adversaries already have copies of these repositories," Nesbitt-Smith told WIRED. "Closing them now won’t put the genie back in the bottle."

Brock added that the real fix is straightforward. Agencies must enforce routine scans, rotate credentials, and stop treating maintenance as optional. Without those changes, hiding code won’t make it more secure—it will just make failures harder to spot.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

Closing public repositories without fixing broken processes hands adversaries a free pass—they already have copies. The real risk isn’t open code; it’s the lack of basic hygiene that allowed credentials to sit exposed for years. Until agencies enforce routine scans and access controls, locking the door won’t matter if the keys are still under the mat.

Key takeaways

• 233 vulnerabilities were found in 33 UK government organizations, exposing sensitive data due to neglected maintenance and process failures.
• The Planning Inspectorate’s exposed credentials could have given attackers full access to SharePoint, OneDrive, and legally protected evidence.
• Open source publishing is not the root cause; poor internal controls and funding squeezes are.
• Stopping open source use without fixing these issues could increase security risks, as adversaries likely already have copies of public code.

Related on Lazyfounder

• UK Home Office’s AI asylum tools may face investigation over bias and transparency
• NHS
• More policy news