Serious flaws found in publicly released UK government code, with lapsed upkeep cited
Withdrawing the code without repairing the underlying faults could leave the problems in place for anyone who already holds a copy.
A security researcher reports finding more than 100 serious flaws in publicly released UK government code, which exposes sensitive information because basic upkeep has lapsed. ControlPlane's Chris Nesbitt-Smith scanned 349 codebases across 33 organisations using consumer AI models on a laptop and found problems in about two-thirds of them. The most severe case involved a leftover login, committed to GitHub, at the Planning Inspectorate that would have granted sweeping read and write access to Microsoft Entra ID, SharePoint and private employee OneDrive data. The agency says its monitoring spotted the activity in August, that the flaw was fixed within 20 minutes, and that no breach occurred. Nesbitt-Smith argues that withdrawing public code without repairing the underlying faults would make matters worse, since adversaries may already have copies.
Why it matters
The findings show that public code releases can carry live risk long after they are published, and that the exposure is not limited to one agency. A leftover login that could have reached staff email-linked files and private employee storage was caught in one case, but the wider pattern of lapsed upkeep means similar weaknesses may sit in other published government repositories. For readers who follow public-sector technology, the lesson is that releasing code for transparency only helps if it is maintained, and that pulling it offline is not a clean fix because copies may already be circulating.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.