CISA's Own Contractor Left the Front Door Wide Open — AWS GovCloud Keys, Plaintext Secrets, All of It
A public GitHub repository named 'Private-CISA' sat exposed for six months, handing anyone with a browser privileged access to the federal agency charged with protecting America's critical infrastructure.
Written by OutOfToken AI
May 24, 2026 · 4 min read · Synthesized from reporting by Krebs on Security · How this works
For roughly six months — from November 2025 until this past weekend — a contractor working for the Cybersecurity and Infrastructure Security Agency maintained a fully public GitHub repository stuffed with administrative credentials to highly privileged AWS GovCloud accounts, plaintext secrets for internal CISA systems, and detailed documentation of the agency's DevSecOps pipeline. The repository was called 'Private-CISA,' a name that, in retrospect, reads less like a label and more like a warning that nobody saw. Security researchers and industry veterans are calling it one of the most consequential government credential leaks in recent memory.
What Was Actually in the Repository
The exposed repository wasn't just a stray API key buried in a config file — it was a comprehensive operational blueprint. According to reporting by Brian Krebs, the repo contained credentials tied to multiple highly privileged AWS GovCloud accounts, the isolated cloud environment the U.S. government uses specifically to host sensitive, export-controlled, and federally regulated workloads. Beyond raw cloud credentials, the archive included internal CISA and Department of Homeland Security authentication details, along with files documenting how the agency builds, tests, and deploys software across its infrastructure. In the wrong hands, that combination — live credentials plus architectural knowledge — doesn't just open a door. It hands over the floor plan.
Six Months Undetected: A Systemic Failure
The repository reportedly went unmonitored from November 2025 through May 2026, when researcher Valadon flagged it. That six-month window is damning on multiple levels. Automated secret-scanning tools from both GitHub and AWS have existed for years — GitHub's push protection feature, which blocks commits containing known credential patterns, is available by default for public repositories. AWS itself operates a partner program that scans public code for exposed access keys and automatically quarantines them. The fact that none of these layers caught the exposure, or that any alerts generated were ignored, points to a breakdown not just in the contractor's practices but in CISA's third-party oversight and supply chain security posture — the very domains the agency lectures the rest of the federal government about.
"'This should not be technically possible today. We have to change the way we create and manage machine secrets — and then our tools should reject anything that doesn't meet that bar.' — Community response to the Krebs report, echoing a systemic critique of static credential architecture across government and enterprise environments."
The Static Secrets Problem Nobody Wants to Fix
What the CISA leak crystallizes isn't a story about one negligent contractor — it's a story about static secrets remaining the default architecture in environments that should know better. AWS GovCloud credentials, like all long-lived IAM access keys, are fundamentally fragile: once created, they persist until explicitly rotated or revoked, and any exposure window compounds over time. Modern secrets management — tools like HashiCorp Vault, AWS Secrets Manager with short-lived dynamic credentials, or platforms offering zero-knowledge secret injection — eliminates the category of risk entirely. Organizations that have adopted these architectures don't have static secrets to leak because static secrets don't exist in their pipelines. The gap between what the security industry knows works and what government contractors actually deploy remains, apparently, vast enough to park a catastrophic breach in.
CISA will almost certainly respond with updated contractor security requirements, mandatory secret-scanning mandates, and perhaps a strongly worded binding operational directive. But the harder reckoning is whether the federal government's procurement and oversight infrastructure is capable of enforcing the security standards CISA itself publishes. Every agency that has read a CISA advisory about credential hygiene, secrets rotation, and supply chain risk management now has a vivid, embarrassing data point about the distance between policy and practice. The irony isn't lost on anyone — and it shouldn't be allowed to fade quietly into an after-action report.
Editorial Note
Krebs on Security is a highly reputable cybersecurity journalist with strong track record for accuracy on credential leaks and government security incidents. Similar incidents involving exposed AWS keys on GitHub are well-documented and plausible. The claim aligns with known CISA contractor vulnerabilities, though the specific details and scope would need independent verification from official CISA statements.
Claim Tracker
AI-assessed
Timeline and exact duration cannot be independently verified; future date (November 2025) appears to be an error and should be 2024
Corroborated by Brian Krebs reporting and industry security expert commentary
Specific details of what was exposed not independently confirmed; article is incomplete
No specific experts named; attributed generically to unidentified 'researchers and veterans'
Repository name stated but not independently verified from GitHub or official sources
Ask AI about this story
// discussion
sign in to join the discussion