The Scottish Government Open Data Portal Vulnerability Disclosure

ControlPlane’s AI security research team identified a critical vulnerability in a Scottish Government open data portal: a long-lived administrative API token had been compiled into the portal’s public JavaScript, where any visitor could read it and use it to control the service’s administrative API without signing in.

Once reported, the finding was escalated to the Scottish Cyber Coordination Centre (SC3) and resolved: the system owner determined the service was no longer required and permanently decommissioned it. Severity was assessed as Critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classified under CWE-798 (Use of Hard-coded Credentials).

Background

The portal was a single-page application built on the Comprehensive Knowledge Archive Network (CKAN) open data platform, with a React front end. To talk to CKAN, a browser application needs an API credential, and a common shortcut is to pass that credential directly to the front end rather than proxy calls through an authenticated back end. The security question is which credential the browser is given, and what it can do.

The finding

Front-end build tools inline environment variables at build time. Variables with certain prefixes (REACT_APP_* in Create React App and equivalents in other frameworks) are not served from a server; the build step substitutes their literal values into the JavaScript bundle shipped to every browser.

In this deployment, an administrative API token had been supplied to the build in exactly this way and therefore published in the application’s static JavaScript, making it readable by any unauthenticated visitor. The token carried administrative scope and had no expiry, so it remained valid indefinitely.

With that token, an unauthenticated party could call the administrative API as though they were a portal administrator.

Root cause

Treating a build-time environment variable as a server-side secret means anything a front-end build consumes ends up in code the browser downloads. Because the credential that reached the browser was fully privileged, its exposure rendered the service’s access control entirely ineffective: the most prevalent category of OWASP web risk, A01:2025 Broken Access Control.

Potential impact

The exposed token held administrative scope, so it could be used to read administrative account information and to change site configuration. Some configuration values were rendered into the page without sanitisation, which meant a configuration change could, in turn, have introduced a stored cross-site scripting condition affecting visitors.

Coordinated disclosure and remediation

After confirming the service was in scope, the report was triaged as critical and escalated to SC3. The system owner paused the server, confirmed the application was no longer needed, and took it permanently offline. Retiring an unneeded service removes the vulnerability and its maintenance burden.

Disclosure timeline (dates only):

Responsible testing and data handling

Testing followed a minimum-necessary approach in line with the Scottish Government’s vulnerability disclosure policy: verification was non-destructive, limited to what was required to demonstrate the issue, and any values changed during validation were restored.

The broader lesson

Three practices prevent this class of exposure:

1. Treat every front-end build input as public. If a value must remain secret, it cannot be included in a client-side build; route privileged API calls through an authenticated back end that stores credentials server-side.
2. Prefer short-lived, narrowly scoped tokens. A non-expiring administrative token maximises the blast radius of any leak.
3. Retire zombie infrastructure. Estates accumulate services that are still online but no longer maintained; an inventory that surfaces and decommissions them removes risk before anyone has to disclose it.

About this work

ControlPlane is an AI-native cybersecurity consultancy specialising in cloud native security, secure software supply chains, and the assurance regimes that regulated organisations depend on. We help teams build and modernise services so that credentials never reach code that ships to users. If you are modernising public-facing services and want to do so securely, we would be happy to talk.