Source time Edition date
Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information
英国政府各网站的安全漏洞暴露“神级”信息
A researcher's sweep of public code found private data at risk across multiple UK departments, a warning for anyone trusting government sites with personal information.
Judgment
UK government departments—especially the Planning Inspectorate and NHS—must decide whether to keep publishing code while funding routine hygiene, or close repositories without fixing flaws and lose outside scrutiny; closure alone cannot revoke copies adversaries may already hold.
Basis
Chris Nesbitt-Smith found more than 100 serious vulnerabilities in 349 public sector codebases across 33 organizations; around two-thirds had flaws. At the Planning Inspectorate, credentials accidentally committed to GitHub gave Microsoft Entra ID “god-tier” read/write access to SharePoint sites, private OneDrive accounts, HR records and legal-hold libraries. The agency says its monitoring detected his August activity, it fixed the issue within 20 minutes of the report and verified no data breach. Amanda Brock says the case is internal housekeeping, not an open source security issue. Nesbitt-Smith argues that closing repositories without fixing them is the “worst case scenario” because adversaries likely mirrored the code, so closure can hide flaws without removing access.
- Codebases scanned349
- Organizations33
- Serious vulnerabilitiesmore than 100
- Planning Inspectorate fixwithin 20 minutes
Unclear The source does not say whether any fixes beyond the Planning Inspectorate’s were independently verified, or how many of the 100-plus vulnerabilities remain unresolved.
Next Check whether the UK government or affected departments publish a remediation register with dates and verification for the 349 codebases scanned and the 100-plus vulnerabilities found.