The UK government's collection of open source code is full of vulnerabilities, with an array of credentials including Microsoft logins at risk.

That's according to research by ControlPlane, which found such issues in two-thirds of the 349 codebases scanned across 33 public sector organizations, according to a report in .

Since 2017, public sector bodies in the UK are generally required to publish code they develop under an open source license to cut costs, boost collaboration, and let external users improve the work — which is exactly what ControlPlane security researcher Chris Nesbitt-Smith has done.

Using Claude Opus and Sonnet, Nesbitt-Smith dug out potential vulnerabilities in published public sector code. In one instance, the Planning Inspectorate failed to remove Microsoft Entra ID credentials after publishing to GitHub, where it remained viewable to anyone who noticed for 18 months.

"A single-token request confirmed that the credential was active," ControlPlane noted in a blog post. "This granted access to all SharePoint site collections in the tenant, including potentially sensitive sites and libraries, as well as private employee OneDrive accounts. This highlighted that the scope was wider than necessary for the original integration."

"An attacker in possession of the credential held unconstrained, tenant-wide read and write access across the organization's entire Microsoft 365 estate.”

A spokesperson for the Planning Inspectorate told ITPro: “The researcher’s activity was immediately detected by the Inspectorate’s cyber monitoring and alerting tools and the organisation was already handling this as a cyber incident when they made contact."

They added: “We identified and fixed this vulnerability within 20 minutes of the report and verified that no data breach occurred. We have reviewed and strengthened our systems and processes to prevent this type of issue recurring and we are grateful for the researcher's work and for alerting us to it.”

A wider problem

Notably, that agency is just one of dozens to have similar issues, including an access-control gap in a Department for Education procurement service and an API token leak on the Scottish Government's open data portal, among others.

The ControlPanel research used AI to spot the flaws, but Nesbitt-Smith said the issues were simple and avoidable. "None of this is the level of sophistication that general media is worried about in terms of cyber attacks," Nesbitt-Smith told . "It’s all daft stuff."

The report comes amid wider reports of AI being used to spot security vulnerabilities, as well as wider hacks into critical infrastructure – raising the question of why such flaws have been left to third-party researchers to spot.

"The fact that a researcher identified over 100 serious flaws across dozens of public bodies using consumer grade AI on a laptop should serve as a wakeup call regarding threat asymmetry," said Olly Maxwell, principal security operations analyst at Huntress.

"AI did not introduce these vulnerabilities, but it has completely democratised the cost of discovering them."

Don't ditch open source

Maxwell noted that public code repositories are constantly scraped for flaws by hackers, so if an independent researcher can find such issues it's safe to assume attackers have found them too.

"Crucially, highly capable threat actors do not always exploit this access immediately," he added. "They bank valid administrative keys and quietly establish strategic persistence within environments like SharePoint or legal hold libraries, holding that access until it becomes geopolitically or financially advantageous to strike."

The answer isn't to lockdown codebases or ditch open source ideals, he said, as that's not where the problem lies and risks losing the warnings provided by independent researchers like Nesbitt-Smith.

"Exposing tenant-wide Microsoft Entra ID credentials in a public GitHub repository is not a byproduct of open source philosophy," Maxwell said. "It is a severe breakdown in basic supply chain governance and DevSecOps hygiene."

He added: "There is a vast difference between falling victim to a highly sophisticated zero day exploit and simply handing adversaries your production logins. The government does not need to retreat into the shadows. It needs to mandate strict, automated security gates across the entire software supply chain and treat identity security with the rigorous operational discipline it demands."

FOLLOW US ON SOCIAL MEDIA

You can also .