---
title: "UK Government Code Reuse Policy Exposes Security Risks"
url: https://newscentral.site/uk-government-code-reuse-policy-exposes-security-risks/
language: en
publisher: "News Central Site"
section: "Technology"
published: 2026-11-10T07:00:00.000Z
updated: 2026-11-10T07:49:44.288Z
id: 8e472244-50b0-4aca-9ec4-88c953522fb0
source: "Wired https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/"
attribution: "Link to https://newscentral.site/uk-government-code-reuse-policy-exposes-security-risks/ and name News Central Site when you quote or summarize this story."
---

# UK Government Code Reuse Policy Exposes Security Risks

The UK government's open-source code reuse policy has led to security vulnerabilities on several high-profile websites.

The UK government has been publishing its code openly for over a decade, making it easier for others to reuse and build upon. This policy applies across various departments, including health, home affairs, and local authorities. The decision is based on transparency and cost-efficiency, allowing developers to share and improve existing code without incurring additional expenses.

However, the pursuit of cost-savings has led some government departments to neglect their technology infrastructure. Funding squeezes have resulted in a backlog of maintenance and improvement tasks, leaving systems vulnerable to security risks. Despite these challenges, researchers have identified significant vulnerabilities across UK government websites.

A recent investigation uncovered serious security flaws on several high-profile sites, including the Planning Inspectorate. In one instance, a login was left exposed after being accidentally committed to a public GitHub repository. This oversight granted unauthorized access to sensitive areas of the site, including employee OneDrive accounts and HR records.

According to Chris Nesbitt-Smith, a researcher at ControlPlane, these vulnerabilities are not indicative of sophisticated cyber attacks. Using consumer-grade AI models on his laptop, he identified several issues that could have been caught through routine IT checks. The severity of the flaws is concerning, however, as they expose sensitive information and potentially compromise security.

The Planning Inspectorate's exposed login would have provided "god-tier" access to SharePoint sites and private employee accounts, including those containing evidence under legal hold for planning inquiries and appeals. This raises questions about the adequacy of current security measures across UK government websites, particularly in light of funding constraints that may be hindering effective maintenance and improvement efforts.

The Planning Inspectorate's swift response to the vulnerability reported by ControlPlane is a testament to its robust cyber monitoring tools.

Upon detecting Nesbitt-Smith's activity in August, the agency immediately treated it as a cyber incident and took prompt action to address the issue.

In fact, the agency was able to identify and fix the vulnerability within an impressive 20 minutes of being notified, confirming that no data breach had occurred.

The Planning Inspectorate has since reviewed its systems and processes, implementing additional measures to prevent similar incidents in the future.

A spokesperson for the agency expressed gratitude towards ControlPlane for alerting them to the issue, highlighting the importance of collaboration between organizations and security researchers.

A vulnerability was discovered in a Scottish Government open data portal, allowing visitors to read administrative account information and modify site configuration.

The issue has since been addressed by the organization. This finding comes as some experts are now advocating for public sector departments to reconsider publishing source code online, particularly given the rapid acceleration of AI-driven vulnerability discovery.

Some have argued that this shift could exacerbate existing security concerns if not properly managed, potentially leaving vulnerable systems exposed without adequate oversight.

A leading expert warned that simply removing access to open source code without addressing underlying issues would be counterproductive and likely draw unwanted attention to potential vulnerabilities.

---
Source: [Wired](https://www.wired.com/story/security-flaws-across-uk-government-sites-exposed-god-tier-information/)  
Published by News Central Site: https://newscentral.site/uk-government-code-reuse-policy-exposes-security-risks/