Key Takeaways
- A public GitHub repository named “Private CISA” exposed 844 MB of internal data, including AWS GovCloud admin keys and plaintext passwords, for roughly six months before disclosure.
- CISA confirmed the leak quickly but took over 48 hours to revoke the compromised AWS keys and other secrets, citing system complexity and interconnections with partners.
- The agency’s incident‑response playbook did not cover leaks involving GitHub or other cloud services, highlighting a gap in preparedness for developer‑secret exposures.
- Reporting channels were unclear, causing the researcher to contact multiple avenues (contractor email, vulnerability‑disclosure platform, media) before the issue reached the right internal team.
- CISA acknowledges the need for mature, well‑tested key‑management practices, continuous scanning of public code repositories, and distinct reporting paths for infrastructure versus product vulnerabilities.
- The agency’s transparent postmortem, adoption of zero‑trust principles, and enhanced logging helped confirm that no customer or mission data was accessed and that leaked credentials were not abused outside CISA environments.
Background of the Leak
On May 15, 2026, the security firm GitGuardian alerted KrebsOnSecurity to a public GitHub repository titled “Private CISA” that contained 844 MB of sensitive CISA‑related data. Among the exposed files were “importantAWStokens,” which held administrative credentials for three Amazon AWS GovCloud servers, and “AWS-Workspace-Firefox-Passwords.csv,” a plaintext list of usernames and passwords for dozens of internal CISA systems. The repository remained accessible for approximately six months, allowing anyone with internet access to download the secrets. The leak originated from a contractor who inadvertently published the data while working on a project, and the exposure went unnoticed until external researchers detected it via automated secret‑scanning tools.
Discovery and Notification
GitGuardian’s continuous scanning of public code repositories generated nine automated alerts about the exposed credentials prior to the May 15 notification. Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity, noted that none of those alerts elicited a response from CISA. After the initial alert, KrebsOnSecurity reached out to CISA, which acknowledged the issue promptly but required more than 48 hours to invalidate the compromised AWS keys and rotate other leaked secrets. Valadon emphasized that the delayed response transformed what could have been a one‑day incident into a half‑year exposure, underscoring the importance of treating external leak notifications with urgency.
CISA’s Response Timeline and Challenges
In its postmortem, CISA admitted that the agency’s initial reaction was slower than ideal. The report attributes the delay to the “complexities of the agency’s systems and interconnections with federal and industry partners,” which made key rotation more time‑consuming than anticipated. Despite the lag, CISA confirmed that enhanced logging and zero‑trust architecture enabled analysts to verify that no customer or mission data was accessed and that the leaked credentials were not used outside CISA’s controlled environments. The contractor responsible for the leak had their system access revoked once the breach was confirmed.
Reporting Channel Deficiencies
CISA’s analysis identified a critical flaw in its incident‑reporting infrastructure: the absence of clear, distinct pathways for reporting vulnerabilities affecting the agency’s own infrastructure versus those impacting its products or customers. Because the channels were not well defined, the security researcher attempted several routes—emailing the contractor directly, submitting through CISA’s vulnerability‑disclosure platform (intended for community‑wide cybersecurity issues), and ultimately involving a reporter—before the alert reached the appropriate internal team. The postmortem recommends publishing reporting instructions in multiple prominent locations, maintaining an easily accessible security.txt file, and ensuring that leaks about internal systems are routed separately from product‑bug queues.
Lessons on Key Management and Continuous Scanning
The incident reinforced the necessity of mature, well‑tested key‑management capabilities. CISA’s report urges organizations to rotate secrets promptly, maintain inventory of developer credentials, and employ automated tools that continuously scan public repositories like GitHub for exposed secrets. Valadon’s commentary echoed this, noting that “continuous monitoring of public GitHub surfaced [the leak]; comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.” Consequently, CISA has rotated all exposed secrets, instituted an action plan to improve developer‑secret management, and committed to ongoing, rather than quarterly, secret‑scanning practices.
Transparency and Future Improvements
Despite the shortcomings, Valadon praised CISA for publishing a detailed postmortem and for being the first national cybersecurity agency to publicly advocate for secrets scanning and for simplifying relations with security researchers. He regarded the transparency itself as a major takeaway, stating that such open communication should be the standard expectation for all organizations. CISA’s commitment to refining reporting channels, enhancing logging, adhering to zero‑trust principles, and maintaining continuous vigilance over exposed secrets reflects a proactive effort to prevent similar incidents and to strengthen overall resilience against credential leaks.