UK Public Sector GitHub Observatory
What a UK public body is actually told to do with a public code repository, by whom, and what this site can see about whether it happened. Three sources, and the most important thing on the page is that they do not have the same scope.
The estate, against the checklist
Who says what, and to whom
| Source | Applies to | What it is |
|---|---|---|
| Protect your code repository NCSC |
Any UK organisation | Ten principles from the national technical authority. Principles, not rules: they tell you what to achieve rather than which button to press. |
| Making source code open and reusable GOV.UK Service Manual |
Central government services, and suppliers building for them | The only source here that says must. Publish the code, licence it under an OSI-compatible licence, keep out unannounced policy, fraud logic, keys and credentials. About openness rather than security. |
| Git configuration exposure Government Cyber Unit, DSIT |
Government bodies | A vulnerability knowledge-base entry. Specific, remedial, and about web servers rather than about GitHub. |
| Creating a new repository GOV.UK Developer Documentation |
alphagov only | The working manual of the GOV.UK programme. Detailed, mandatory within GOV.UK, and not a standard anybody else has agreed to or should be measured against. |
Read down the "applies to" column and the gap is the finding. Central government has a mandatory rule about publishing code and an internal manual, in one programme, about how to configure a repository. Nobody has a mandatory rule about securing one: NCSC's ten principles are guidance to everybody and binding on nobody, and DSIT's entry covers a single vulnerability class. A council or an NHS trust is outside all four. Most of the repositories measured on this site are governed by nothing on this page.
The checklist
Publish it, and licence it
GOV.UK Service Manual applies to central government services
The only mandatory item on this page. The Service Manual's wording is "you must make it open so that other developers (including those outside government) can benefit from your work", under an Open Source Initiative compatible licence — GDS uses MIT as standard, and everything civil servants write is Crown Copyright in any case. Unannounced policy and fraud-prevention logic stay closed; keys and credentials are never in the source at all.
Measured here: Presence of a licence file, by sector. A repository without one is published but not reusable, which fails the purpose the requirement exists for even though the code is visible.
In this estate: 76% of live central government repositories carry a licence (6,735 of 8,893), against 57% in local government — which is not bound by this requirement and has no equivalent of its own.
Open from the first commit, not at the end
NHS Service Manual applies to NHS digital services
NHS Service Standard point 12 asks teams to "write code openly from the start" and keep it in an open repository, minus keys and credentials, with the organisation retaining the intellectual property and releasing under an open licence. The phrasing matters: opening a repository at the end of a project means auditing its whole history first, which is the step that gets skipped.
Measured here: Presence of a licence file in live, non-forked repositories belonging to health bodies. Whether code was open from the start is not visible from outside - a repository made public on day one and one made public on its last day look identical.
In this estate: 69% of live health repositories carry a licence (691 of 1,004). This is the first requirement on this page that NHS bodies are actually subject to; every other one above was written for somebody else.
The whole history has to be publishable
Analysis Function, ONS applies to government analysts
The Analysis Function's guidance for government analysts is open by default, an MIT-style licence, and raw data, outputs, configuration and credentials kept outside the repository rather than removed later. Its sharpest line is that "the entire version history must be safe to share, not just the latest version" — deleting a file does not unpublish it. Counter-fraud logic, statistical disclosure control and unreleased policy analysis stay closed.
Measured here:
Files with a data extension committed into the repository tree - .csv, .xlsx, .sqlite and relatives. Measured from filenames only; no file is read. Most will be fixtures and published open data sitting exactly where they belong, so this is a prompt to look, not a finding.
In this estate: Counted on the contents page, which reports what is committed across the estate. Everyone scans government code for secrets; almost nobody asks whether a spreadsheet went in by accident.
Take care of your identity
NCSC applies to any UK organisation
Limit the personal information in a public repository, because a name and a work address together are what a spear-phishing campaign needs. GitHub's noreply address and an organisation-issued account are the two standard controls, and both are free.
Measured here: Every committer email in every live, non-forked repository, grouped by domain. This is the measurement the whole site is built on.
In this estate: 67,678 of 276,555 committer rows (24%) carry a public sector work address across 573 distinct domains. 38% use GitHub's noreply address. The agencies that solved this are the subject of a separate writeup; nobody else has.
Review all code changes
NCSC applies to any UK organisation
Nothing reaches the main branch without review. In GitHub terms that is a branch protection rule, and the two artefacts that make it work in practice are a CODEOWNERS file, so review lands on somebody, and a pull request template, so the reviewer is told what to check.
Measured here:
Presence of CODEOWNERS and a PR template in the repository tree. Branch protection itself is a setting rather than a file and is not visible from outside, so this is a floor rather than a count.
In this estate: 15% of live repositories carry a CODEOWNERS file and 11% a pull request template.
Separate secrets from source code
NCSC applies to any UK organisation
Credentials never enter the repository, there is a defined way to inject them, keys are rotated, and automated scanning looks for the ones that got in anyway.
Measured here: Not measured. Finding secrets means reading file contents and pattern-matching them, and publishing the result would be publishing a list of live credentials. GitHub's own secret scanning already does this privately and tells the owner, which is the right place for it.
In this estate: No figure, deliberately. The nearest visible proxy is whether an organisation has published a way to be told — see the next rule.
What the scanning actually looks like
Hackney Council playbook applies to one council's own practice
The rule above says "automated scanning" and stops. Hackney's playbook is the only published account in this estate of what that means in practice: GitGuardian's ggshield wired into pull requests so a scan runs before review, covering over 300 secret types, and — the part most policies miss — monitoring developers' personal repositories as well as the organisation's, because that is where work code tends to leak to. It is framed as an alerting and remediation workflow rather than a blocking gate.
Measured here: Not measured, and not a standard. This is one council's internal playbook, published openly, binding nobody but Hackney. It appears here because a concrete worked example of a control is more use to a reader than another instruction to have one, and because almost nothing else aimed at local government has been published at all.
In this estate: No figure. The point of citing it is that it exists: an estate of 32 councils has one published account of how to do this, and it came from a borough of 280,000 people.
Give people a way to report a problem
NCSC applies to any UK organisation
A public repository will eventually receive an unsolicited security report. NCSC's guidance on running open code assumes somebody is there to receive it; a SECURITY.md is how GitHub surfaces that route, and the government's own vulnerability disclosure toolkit says the same thing about services.
Measured here:
Presence of SECURITY.md in the repository tree, and separately whether the organisation's domains publish a security.txt.
In this estate: 3% of live repositories carry a SECURITY.md. The domain side is on the domains page.
Include open code in your risk model
NCSC applies to any UK organisation
Decide deliberately what should be public. Where code is public, apply the practices that make public code safe: automated testing, peer review, and a licence that says what others may do with it.
Measured here: Licence presence, CI presence and test directories, per repository, across the estate.
In this estate: 69% carry a licence and 34% have CI visible in the repository. A repository with no licence is not reusable by anyone, which quietly defeats most of the reason for publishing it.
Keep dependencies current
NCSC applies to any UK organisation
Dependency automation is the cheapest control on this list and the one with the clearest failure mode: an unmaintained dependency is a vulnerability you will learn about from somebody else.
Measured here: Dependabot or Renovate configuration, counted only in repositories that actually have a dependency manifest — scoring a repository of Markdown on this would be noise.
In this estate: 2,094 of 7,012 (30%) repositories with a manifest have dependency automation.
Archive or maintain - not neither
NCSC applies to any UK organisation
NCSC's guidance assumes somebody is looking after the repository. The failure this site sees most often is neither maintenance nor retirement: a repository left live, still accepting issues and pull requests, with nobody behind it.
Measured here: Live repositories with no commit for more than two years, against the deletion log, so that removing an embarrassing repository does not read as improvement.
In this estate: 4,767 of 15,274 live repositories (31%) have had no commit in two years and are not archived. Separately, 1,774 repositories have been deleted outright — see the writeup.
Do not deploy the .git directory
Government Cyber Unit, DSIT applies to government bodies
The Government Cyber Unit's knowledge-base entry is about the other end of the same estate: a .git directory left readable on a live web server hands over the whole history, including whatever was committed and later removed. The remedies are to block the path at the web server, deploy only the files the application needs, and delete the directory from any server where it is already exposed.
Measured here:
Not measured, on purpose. Checking would mean requesting /.git/config from government web servers to see how they answer. Everything this project collects is either published for the purpose or is a clone of a repository whose owner made it public; probing for a path that should not exist is a vulnerability scan of somebody else's infrastructure, and it is not done here.
In this estate: No figure. If you run one of these estates, this is the item on the list you can check in an afternoon and nobody outside can check for you.
Create the repository through Terraform, with the required checks
GOV.UK Developer Documentation applies to alphagov only
GOV.UK repositories are created and managed by Terraform, with an entry in repos.yml carrying the required review and status-check settings, and Dependency Review and CodeQL enabled — plus Brakeman for Rails applications. It also requires a README and a licence.
Measured here: Nothing estate-wide. This is alphagov's internal manual, not a cross-government standard, and no organisation outside GOV.UK is measured against it anywhere on this site. It is here because it is the most detailed public example of a UK government team writing its own repository standard, and because the parts of it that are generic — a README, a licence, required review, automated scanning — are the same items NCSC asks everybody for.
In this estate: See documentation versus reality, which compares GOV.UK's manual against GOV.UK's repositories and nobody else's.
What this adds up to
There is no procurement on this page. A licence file, a SECURITY.md, a CODEOWNERS, Dependabot and GitHub's noreply address are all a few minutes each and none of them needs anybody's permission. The measurements above are not a story about underfunding; they are a story about nobody having been asked.
Sources are linked in full above and nothing here paraphrases them beyond what a reader can check. Figures cover live, non-forked, non-archived repositories across 210 harvested organisations, recomputed on every build. Organisations that no longer exist are included in the totals — they published what they published — but are never used as an example of current practice. See Method.