UK public sector / Everything this site cannot see

15 August 2026 · method infrastructure self-criticism

Every number on this site starts from the same assumption: that if a UK public body writes software in the open, it does so on GitHub. That assumption is reasonable, it is unexamined, and if it is wrong then an organisation running its own GitLab looks exactly like an organisation that publishes nothing at all. This is what happened when I checked.

How you look for a forge without knocking on doors

The constraint is the same one that governs everything else here: nothing connects to a server to test a configuration, and no path is requested that the operator did not publish. The standards page explains why this project will not scan for exposed .git directories, and the same reasoning applies to hunting for source control.

What is left is DNS and a front door. Conventional hostnames — git, gitlab, gitea, svn, scm, bitbucket and a few more — resolved against 256 domains taken from committer email addresses in the harvest. Those are the domains of bodies that demonstrably write software, which is a far better list than the whole .gov.uk estate, three quarters of which is parish councils. That is 4,096 lookups, of which 109 resolved.

Then one request each, to the root page, which is the same page the domain probe already fetches for every .gov.uk apex. Whatever comes back is matched against the signatures software leaves in a page title, a header or a redirect.

The bit where the answer was nonsense

The raw output said No. 10 Downing Street was running Git, GitLab, Gitea, Bitbucket, Gerrit, Mercurial, Subversion and Stash. Simultaneously. It was not. Three of the domains surveyed answer for any name you ask them for.

Wildcard DNS is a completely ordinary thing to configure and it makes a hostname survey worthless unless you control for it. So every base domain that produced a hit got two more lookups, for labels nobody would ever register. A domain that answers for both is wildcarding, and everything it appeared to host is discarded.

That control removed 48 of the 109 apparent hits — more than two in five — and left 61 hostnames worth fetching. Without it, this post would have been a confident, entirely false claim about the Prime Minister's office, and it would have been the sort of false claim that gets repeated.

A second and smaller trap: review is a word with two meanings. review.tpr.gov.uk is not code review, it is the Pensions Regulator's automatic enrolment review service. It is only excluded because the fetch went and checked rather than trusting the name.

What is actually there

12 forges, of which exactly 1 belongs to government.

The pattern is not subtle. Universities and research institutes run public, self-hosted GitLab as a matter of course — Cardiff, Kent, LSE, Aberystwyth, Bath, Birmingham, City — and St Andrews still serves Subversion. The Science and Technology Facilities Council and the UK Centre for Ecology & Hydrology, both public bodies, do the same. EMBL-EBI is on the list and is worth flagging as not being a UK public body at all: it is the European Bioinformatics Institute, an intergovernmental laboratory that happens to sit in Cambridgeshire.

The one government forge

code.metoffice.gov.uk redirects to /trac/home. It is the Met Office Science Repository Service, and it runs Trac over Subversion — the collaboration platform of choice around 2008, still doing its job in 2026, hosting the code behind the Unified Model and the rest of the Met Office's scientific estate.

It is easy to read that as a punchline and it is not one. Numerical weather prediction code is developed by a consortium across national meteorological services and universities, over decades, with a review culture built around the tooling it already has. Trac and Subversion are unfashionable; they are also stable, well understood by the people using them, and nobody has had to spend a year migrating instead of forecasting. There is a version of "modern engineering practice" that would call this technical debt, and there is another that notices the thing has been running since before GitHub was profitable.

The interesting result is the silence

42 hostnames resolved and then did not answer. Another 7 answered with something that was not a forge — a login page, a 403, an error. Among the names that resolve but do not respond are ones belonging to a health body, a department, a transport authority, a city council and a national legislature.

This survey cannot tell you why. A request from one machine on one network got no reply, and "firewalled to the outside world" and "the service moved and the DNS record did not" look identical from here. The honest statement is narrow: the names are published, and the services behind them are not reachable from the open internet.

That is almost certainly the correct configuration. An internal GitLab is where most government code belongs, and nothing in this project argues otherwise. But it has a consequence for everything else on this site, and the consequence is the actual point of this post.

What it means for every other number here

Every measurement on this site is a measurement of what an organisation chose to publish on GitHub. It was never a measurement of how that organisation works, and this survey is the proof rather than the caveat.

When the comparison page reports that an organisation has CI in a small share of its repositories, the honest reading has always been "CI you cannot see from GitHub", and there is a note saying so. This makes the same point one level up: a department with a well-run internal GitLab and a handful of tidied-up repositories pushed outwards will score worse here than one that dumps everything in public, and it may be doing considerably better engineering.

It also means the estate this project describes is a floor, not a census. There is no way to size what sits behind those unanswering hostnames without asking the organisations, and asking is the correct next step rather than guessing.

Method: 4,096 DNS lookups across 256 domains derived from committer metadata, taken 2026-08-15, wildcard-controlled with two nonsense labels per domain, followed by a single root-page fetch per surviving hostname. Nothing was enumerated, authenticated against, or asked for a path its operator had not published. Run by hand with pipeline/find-forges.py and deliberately not on the weekly schedule — the answer moves on a timescale of years, and the cost of asking falls on other people's infrastructure. A small number of results are held back from this post: some hostnames resolve in ways that describe the inside of an organisation's network, which is of no use to a reader and of some use to an attacker. See Method.

← All writeups