GoKawiilResearcher finds 100+ vulnerabilities in UK government public code repositories
Security researcher Chris Nesbitt-Smith identified over 100 serious vulnerabilities in publicly published UK government code, including at the Department of Health and Social Care, the Home Office, and local authorities. The most severe case involved the Planning Inspectorate, which accidentally committed non-expiring Microsoft Entra ID credentials to GitHub that could have granted full read-write access to all SharePoint sites, private OneDrive accounts, HR records, and legally protected planning inquiry evidence.
GoKawiil's interpretation of the reporting above, not reported fact.
Nesbitt-Smith says he used only consumer-grade AI models on a laptop to find these flaws, suggesting that low-sophistication attackers could exploit similar oversights without advanced resources. The findings point to a gap between the UK government's decade-long policy of open-sourcing publicly funded code and the maintenance resources departments have to keep that code secure amid funding pressures.
- Over 100 vulnerabilities found across UK government published code using consumer-grade AI tools
- Planning Inspectorate's exposed credentials could have given 'god-tier' access to SharePoint, OneDrive, and HR data
- Researcher says the issues reflect basic IT hygiene failures, not sophisticated cyberattack methods
Source: wired.com — Isabella Ward, 2026-11-10
Published there as: “Security Flaws Across UK Government Sites Exposed ‘God-Tier’ Information”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.