Lessons Learned from CISA’s Recent GitHub Leak
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb. On May 15, 2026, the security firm GitGuardian asked for help in notifying CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive CISA-related data. One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems. CISA quickly acknowledged our initial alert, but took more than 48 hours to invalidate the AWS keys and many other important secrets leaked in the GitHub repo. In its report on the data leak , CISA said the complexities of the agency’s systems and interconnections with federal and industry partners caused its key rotation to take longer than anticipated. “Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities,” the report notes. CISA also admitted it can do better when it comes to responding to security incident notifications from external parties. The postmortem stresses that clear and distinct reporting channels are essential to ensure that incidents affecting the organization itself are handled differently from those involving its products or customers. “In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA’s vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter,” reads the analysis written by Preston Werntz and Brad Libbey , the acting chief information officer and acting chief information security officer at CISA, respectively. CISA said it is refining its reporting channels to make them easier and faster for researchers. “Additionally, while many researchers rely on the security.txt file, organizations can ensure clarity by publishing reporting instructions in multiple prominent locations,” the CISA authors wrote. Guillaume Valadon , the GitGuardian researcher who first contacted KrebsOnSecurity about the exposed CISA credentials, said CISA ignored nine automated alerts about the exposed credentials prior to our notification on May 15. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. “Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in an analysis of CISA’s report. “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt , but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue.” The report’s authors also emphasized the importance of continuously scanning public code repositories like GitHub for exposed secrets, and said CISA has since rotated all secrets and created an action plan to improve management of developer secrets and to better monitor for them going forward. The report notes that while CISA had developed a playbook for responding to cybersecurity incidents, that playbook somehow didn’t include what to do in situations involving GitHub or other cloud services. Valadon said the report validates the need to scan continuously — not just quarter…
AI Analysis
Technical Summary
In a significant data leak, a contractor published sensitive CISA credentials, including administrative AWS GovCloud keys and plaintext passwords for internal systems, in a public GitHub repository named “Private CISA.” The repository remained public for almost six months before notification by KrebsOnSecurity, following alerts from the security firm GitGuardian. CISA acknowledged the leak but required over 48 hours to invalidate the exposed credentials due to the complexity of its interconnected systems. The agency's postmortem report emphasized the need for mature key management, clearer incident reporting channels distinct from product vulnerability reports, and continuous scanning of public code repositories for exposed secrets. The report also noted that CISA's existing incident response playbook did not adequately address cloud service exposures like those on GitHub. Following the incident, CISA rotated all secrets and developed an action plan to improve secret management and monitoring.
Potential Impact
The leak exposed administrative credentials to critical AWS GovCloud servers and plaintext passwords for multiple internal CISA systems, potentially allowing unauthorized access to sensitive federal infrastructure and data. The prolonged exposure period of nearly six months increased the risk of exploitation, although no known active exploitation has been reported. The incident also revealed procedural weaknesses in CISA's incident response and external notification handling, which could delay mitigation in future incidents.
Mitigation Recommendations
CISA has rotated all exposed credentials and developed an action plan to improve management and monitoring of developer secrets. The agency is refining its incident reporting channels to ensure that notifications about internal infrastructure leaks are handled promptly and distinctly from product vulnerability reports. Organizations are encouraged to maintain mature, well-tested key management capabilities and to continuously scan public code repositories for exposed secrets. Publishing clear and multiple reporting instructions beyond security.txt files is advised to facilitate timely incident notification and response.
Lessons Learned from CISA’s Recent GitHub Leak
Description
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a recent data leak in which a contractor published dozens of internal CISA credentials — including AWS Govcloud keys — in a public GitHub repository for almost six months before being notified by KrebsOnSecurity. Experts say the gaps identified in the agency’s initial response provide important lessons that all security teams should absorb. On May 15, 2026, the security firm GitGuardian asked for help in notifying CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive CISA-related data. One of the exposed files, titled “importantAWStokens,” included the administrative credentials to three Amazon AWS GovCloud servers. Another file — “AWS-Workspace-Firefox-Passwords.csv” — listed plaintext usernames and passwords for dozens of internal CISA systems. CISA quickly acknowledged our initial alert, but took more than 48 hours to invalidate the AWS keys and many other important secrets leaked in the GitHub repo. In its report on the data leak , CISA said the complexities of the agency’s systems and interconnections with federal and industry partners caused its key rotation to take longer than anticipated. “Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities,” the report notes. CISA also admitted it can do better when it comes to responding to security incident notifications from external parties. The postmortem stresses that clear and distinct reporting channels are essential to ensure that incidents affecting the organization itself are handled differently from those involving its products or customers. “In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA’s vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter,” reads the analysis written by Preston Werntz and Brad Libbey , the acting chief information officer and acting chief information security officer at CISA, respectively. CISA said it is refining its reporting channels to make them easier and faster for researchers. “Additionally, while many researchers rely on the security.txt file, organizations can ensure clarity by publishing reporting instructions in multiple prominent locations,” the CISA authors wrote. Guillaume Valadon , the GitGuardian researcher who first contacted KrebsOnSecurity about the exposed CISA credentials, said CISA ignored nine automated alerts about the exposed credentials prior to our notification on May 15. Valadon’s company constantly scans public code repositories at GitHub and elsewhere for exposed secrets, automatically alerting the offending accounts of any apparent sensitive data exposures. “Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” Valadon wrote in an analysis of CISA’s report. “Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt , but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue.” The report’s authors also emphasized the importance of continuously scanning public code repositories like GitHub for exposed secrets, and said CISA has since rotated all secrets and created an action plan to improve management of developer secrets and to better monitor for them going forward. The report notes that while CISA had developed a playbook for responding to cybersecurity incidents, that playbook somehow didn’t include what to do in situations involving GitHub or other cloud services. Valadon said the report validates the need to scan continuously — not just quarter…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In a significant data leak, a contractor published sensitive CISA credentials, including administrative AWS GovCloud keys and plaintext passwords for internal systems, in a public GitHub repository named “Private CISA.” The repository remained public for almost six months before notification by KrebsOnSecurity, following alerts from the security firm GitGuardian. CISA acknowledged the leak but required over 48 hours to invalidate the exposed credentials due to the complexity of its interconnected systems. The agency's postmortem report emphasized the need for mature key management, clearer incident reporting channels distinct from product vulnerability reports, and continuous scanning of public code repositories for exposed secrets. The report also noted that CISA's existing incident response playbook did not adequately address cloud service exposures like those on GitHub. Following the incident, CISA rotated all secrets and developed an action plan to improve secret management and monitoring.
Potential Impact
The leak exposed administrative credentials to critical AWS GovCloud servers and plaintext passwords for multiple internal CISA systems, potentially allowing unauthorized access to sensitive federal infrastructure and data. The prolonged exposure period of nearly six months increased the risk of exploitation, although no known active exploitation has been reported. The incident also revealed procedural weaknesses in CISA's incident response and external notification handling, which could delay mitigation in future incidents.
Defensive Guidance
CISA has rotated all exposed credentials and developed an action plan to improve management and monitoring of developer secrets. The agency is refining its incident reporting channels to ensure that notifications about internal infrastructure leaks are handled promptly and distinctly from product vulnerability reports. Organizations are encouraged to maintain mature, well-tested key management capabilities and to continuously scan public code repositories for exposed secrets. Publishing clear and multiple reporting instructions beyond security.txt files is advised to facilitate timely incident notification and response.
Technical Details
- Article Source
- {"url":"https://krebsonsecurity.com/2026/07/lessons-learned-from-cisas-recent-github-leak/","fetched":true,"fetchedAt":"2026-07-14T11:17:52.604Z","wordCount":1324}
- Classification
- {"confidence":0.69,"severitySource":"default","classifier":"rss-v2"}
Threat ID: 6a561ae168715ace4363c08f
Added to database: 07/14/2026, 11:17:53 UTC
Last enriched: 08/07/2026, 05:43:00 UTC
Last updated: 08/27/2026, 17:00:47 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.