Politics news and discussion on TalkFuse.
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
A security researcher found vulnerabilities in publicly available code used by UK government bodies, including a serious exposed credential at the Planning Inspectorate. The case matters because the credential could have opened access to extensive government and employee data, while the broader findings raise questions about neglected maintenance and calls to restrict open publication of public-sector code.
Researcher Chris Nesbitt-Smith scanned 349 codebases across 33 organisations and said about two-thirds contained vulnerabilities. The Planning Inspectorate said its monitoring detected his activity in August, that it fixed the issue within 20 minutes of being alerted, and that it found no data breach. Other findings involved Department for Education services and a Scottish Government data portal; the organisations have since addressed the reported issues.
In short
- Exposed credentials could have given wide access to Planning Inspectorate files.
- About two-thirds of 349 public-sector codebases scanned had vulnerabilities.
- The researcher argues that fixing flaws matters more than hiding code.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
Publicly releasing government code can improve transparency, enable independent security scrutiny and help departments share useful tools. The reported flaws were found through that scrutiny, and the Planning Inspectorate says it fixed the exposed credential within 20 minutes and found no breach. Keeping code open may therefore strengthen security when organisations maintain it properly and respond quickly to reports.
The case against
Publishing code and related credentials can create risks when departments fail to maintain systems or prevent sensitive information from being exposed. The researcher found vulnerabilities in about two-thirds of 349 codebases, and the Planning Inspectorate flaw could have opened access to substantial government and employee data. Those concerned about exposure can argue that tighter controls on what is published, alongside stronger maintenance and security checks, are needed to protect public services and personal information.
Explained simply
UK public bodies publish some of the software code used to run their websites and services. Security researchers can examine this code for weaknesses, including credentials that may give access to internal systems or data.
Chris Nesbitt-Smith examined codebases linked to 33 organisations, including the Planning Inspectorate, the Department for Education and the Scottish Government. The Planning Inspectorate said it fixed a reported issue and found no evidence of a data breach.
The case sits within a wider debate about how public bodies maintain software and whether publishing code helps scrutiny or creates security risks. The stakes include protecting public services and the personal information they hold.