Summary
- A researcher identified vulnerabilities in approximately two-thirds of 349 public sector codebases examined across 33 organisations.
- Published Planning Inspectorate credentials reportedly retained extensive permissions over Microsoft 365 records and planning material.
- The Inspectorate says monitoring detected the activity, the issue was corrected after notification and no data breach occurred.
Security weaknesses in publicly available UK government software have exposed gaps in credential management and application maintenance, including a case in which published login details reportedly provided extensive access to sensitive records held by the Planning Inspectorate.
Security researcher Chris Nesbitt-Smith, working at ControlPlane, examined 349 public sector codebases associated with 33 organisations and identified vulnerabilities in approximately two-thirds of those reviewed.
His findings, detailed in an investigation published by WIRED on 10 November, included more than 100 serious security issues. The review used commercially available AI models to help inspect code, although the researcher indicated that many of the weaknesses could have been identified through established security testing practices.
The most consequential reported finding involved Microsoft Entra ID credentials accidentally committed to a public GitHub repository by the Planning Inspectorate, which handles planning appeals, examinations and other statutory processes in England.
According to the researcher, the credentials retained extensive permissions and could have enabled read and write access to SharePoint sites and private employee OneDrive accounts, potentially including human resources information and evidence associated with planning inquiries.
Those reported permissions describe possible access arising from the exposed credentials, not proof that an attacker obtained or misused the records.
Agency says no data breach occurred
In its response to the investigation, the Planning Inspectorate said its monitoring systems detected the researcher’s activity in August 2026 and that it was already treating the matter as a cybersecurity incident when ControlPlane contacted it.
The agency said it identified and corrected the vulnerability within 20 minutes of notification, reviewed its systems and processes, and verified that no data breach had occurred.
The distinction between an exposed credential and confirmed data theft is essential. Credentials with broad permissions can create considerable risk without establishing that unauthorised access to the underlying information took place.
Other reported findings concerned Department for Education services, including systems associated with school procurement and teacher applications. A separate issue in a Scottish Government open data portal reportedly created opportunities to view administrative account information and alter configuration settings.
The investigation states that the organisations involved have addressed the identified weaknesses. It does not establish a coordinated attack against those departments, and the findings should not be characterised as evidence of a widespread government data breach.
Public code requires active security ownership
The research comes as the government continues to defend its longstanding policy of making publicly funded source code available for reuse and scrutiny, while setting conditions for protecting sensitive information and maintaining deployed systems.
In guidance published in May 2026, the Government Digital Service and Department for Science, Innovation and Technology acknowledged that AI-assisted analysis can reduce the time required to identify vulnerabilities.
The guidance nevertheless maintains that public code should remain the default in appropriate circumstances. It identifies weaknesses in system implementation, configuration, maintenance and remediation capability as primary sources of exploitation risk, rather than the publication of source code alone.
Government requirements already prohibit committing passwords, tokens and similar secrets to public repositories. Teams are expected to maintain defined ownership, implement automated secret detection, manage software dependencies and provide a clear process for reporting and resolving vulnerabilities.
A credential accidentally committed to version control can remain exposed even after developers remove it from the latest code. Copies may persist in repository history, development environments or material already downloaded by third parties. Remediation consequently depends on revoking or rotating the affected credential and reviewing the permissions attached to it, rather than merely deleting the visible reference.
The Planning Inspectorate case also raises questions about the privileges assigned to application identities. A leaked credential with tightly limited permissions presents a different risk from one capable of reading and modifying data across numerous services.
Similarly, successful monitoring and rapid response can reduce the impact of an exposure without removing the need to understand why the credential was published or why its permissions remained available.
AI-assisted code inspection adds further pressure to these established controls. Tools that make legitimate security review faster can also reduce the effort required to locate weaknesses in public codebases, although access to source code does not by itself establish that a deployed application can be exploited.
Under current government guidance, repository openness is therefore expected to operate alongside accountable maintenance, secure application design and effective remediation. The Planning Inspectorate says it has strengthened its systems and processes, while the wider research identifies weaknesses that public sector organisations have since addressed.
