Six Months, Three GovCloud Keys, One Very Public Postmortem
CISA's own contractor leaked the agency's cloud credentials to GitHub for nearly half a year — and the cybersecurity agency's response to its response is the real lesson.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by Krebs on Security · How this works
The agency tasked with defending America's critical infrastructure spent almost six months unaware that one of its own contractors had published sensitive internal data to a public GitHub repository. When security researchers finally forced the issue in May 2026, CISA did something rare in government or industry: it published a detailed, public postmortem admitting exactly what went wrong.
The repo nobody was watching
The exposure centered on a public GitHub repository called "Private-CISA," hosted not on CISA's official GitHub environment but on a contractor's personal account. According to CISA and researchers who examined the leak, it sat exposed from roughly November 2025 to May 2026, containing 844 MB of infrastructure and deployment code with embedded credentials.
What was actually inside
Among the exposed files was one labeled "importantAWStokens," containing administrative credentials for three Amazon AWS GovCloud servers. Another file, "AWS-Workspace-Firefox-Passwords.csv," listed plaintext usernames and passwords for dozens of internal CISA systems — the kind of static secrets that security teams spend years warning against hardcoding anywhere, let alone a public repo.
Discovery came from outside, not inside
The leak wasn't caught by CISA's own monitoring. Security firm GitGuardian discovered the exposed repository on May 14, 2026, and reportedly got it taken down within roughly 26 hours of finding it. But getting the actual agency notified proved harder than pulling the repo — GitGuardian had to enlist KrebsOnSecurity's help to reach the right people inside CISA.
"A public repository sat exposed for close to six months, leaking GovCloud admin keys and plaintext passwords, before the agency responsible for national cyber defense even knew it existed."
What CISA got right
Once notified, CISA's internal logging held up. The agency said comprehensive logs allowed it to rule out credential abuse or intrusion tied to the exposed keys, meaning the leak, however long it lasted, apparently wasn't actively exploited. That's a meaningful distinction — exposure without confirmed compromise — but it doesn't excuse the length of the exposure window.
The gaps the agency admitted to
CISA's postmortem, published roughly two months after the incident, laid out where its posture fell short. The agency pointed to the need for continuous monitoring of public code repositories for exposed secrets, stronger incident response coordination, and clearer channels for outside researchers to report findings quickly rather than routing through intermediaries.
Why this matters beyond CISA
Security practitioners who reviewed the report, including researchers involved in the original discovery, have called it unusually candid for an organization of CISA's size. Most breaches of this nature get buried in legal review or quietly patched without public accounting. CISA instead detailed what worked, what failed, and invited other organizations to learn from its mistakes — a posture security teams rarely see from vendors, let alone government agencies.
The underlying problem — static secrets sitting in code repositories, personal contractor accounts operating outside official monitoring, and slow paths for outside researchers to reach the right people — is not unique to CISA. It's the default state of most enterprise environments. The agency's willingness to name its own failures publicly may end up being more valuable to the broader security community than the incident itself was damaging.
Editorial Note
The research corroborates all major factual claims in the article: the repository name, size, exposure timeline, specific file names and credentials exposed, discovery date, takedown timeline, and involvement of GitGuardian and KrebsOnSecurity. The research also confirms CISA's logging capabilities and lack of active exploitation. No contradictions or significant gaps were found between article claims and source material.
Claim Tracker
AI-assessed
Source 2 (GitGuardian blog) confirms 844 MB of sensitive CISA data found on May 14, 2026. Source 6 (Akeyless) confirms the repository sat unmonitored from November 2025 to May 2026.
Source 1 (Krebs on Security) explicitly confirms the file 'importantAWStokens' included administrative credentials to three Amazon AWS GovCloud servers.
Source 2 (GitGuardian blog) states 'On May 14, 2026, we found...and got it taken down in 26 hours.'
Source 1 (Krebs on Security) states 'the security firm GitGuardian asked for help in notifying CISA' on May 15, 2026.
Source 5 (Cybersecurity Dive) confirms 'Comprehensive logs allowed CISA to rule out the possibility of credential abuse and intrusions.'
Ask AI about this story
// discussion
sign in to join the discussion