CISA Left AWS GovCloud Keys on GitHub for Six Months, Ignored Nine Alerts
The US cyber agency's own postmortem admits it missed automated warnings, muddled its reporting channels, and took two days to rotate leaked admin credentials.
Key points
- A contractor working for the US Cybersecurity and Infrastructure Security Agency (CISA) left 844 MB of internal data in a public GitHub repository called "Private CISA" for nearly six months.
- The exposed files included administrative keys to three Amazon Web Services (AWS) GovCloud servers and a spreadsheet of plaintext usernames and passwords for dozens of internal CISA systems.
- Security firm GitGuardian sent nine automated alerts about the leak before CISA acted on a May 15, 2026 tip routed through KrebsOnSecurity.
- Rotating the leaked AWS keys took over 48 hours after CISA was notified, with the agency citing the complexity of its federal system connections.
- CISA says its detailed logs show no customer or mission data was accessed, and the contractor's access has been revoked.
This one hurts to write up.
CISA, the federal agency that tells everyone else how to run cloud security, just published a postmortem on how one of its own contractors dumped admin credentials into a public GitHub repository. GitHub is the site software developers use to store and share code. The repository sat open to anyone with a browser for nearly six months.
Inside were files with names that make any engineer wince. One was called "importantAWStokens" and held admin keys to three AWS GovCloud servers, the fenced-off version of Amazon's cloud used by US government agencies. Another, "AWS-Workspace-Firefox-Passwords.csv", listed logins for dozens of internal CISA systems with no encryption, no scrambling. Just credentials sitting in a spreadsheet.
The leak was originally flagged by KrebsOnSecurity after GitGuardian researcher Guillaume Valadon, whose company scans public code repositories for exposed secrets, got nowhere through official channels.
How did CISA miss this for six months?
Nobody read the emails. GitGuardian sent nine automated notifications to CISA before finally involving a reporter. That's how a one-day problem stretches into a half-year exposure.
CISA's own writeup, by acting CIO Preston Werntz and acting CISO Brad Libbey, is candid about why. The agency had no clear channel for an outside researcher to report that its own infrastructure was leaking. Valadon tried emailing the contractor directly. He tried CISA's vulnerability disclosure platform, which is designed for flaws in products CISA oversees rather than the agency itself. Nothing worked until a journalist got involved.
The failure mode here is one every large organisation has: the inbox for "our stuff is on fire" is the same inbox as "we found a bug in your product," and whoever's on triage duty routes it to the wrong queue.
Even after CISA was notified, getting the AWS GovCloud keys rotated took well over two days. The agency cited the complexity of its interconnections with federal and industry partners. Translation: they didn't know everywhere those keys were used, so pulling them risked breaking things.
What actually went right?
Give credit where it's due. CISA had good logging turned on and had adopted zero trust, a security approach where every request is verified regardless of where it originates. Those two things let investigators show the leaked credentials were never used from outside CISA's environment and that no mission or customer data left the building.
The agency has rotated every exposed secret, revoked the contractor's access, and says it's rewriting its incident playbook to cover GitHub and other cloud services. Which, yes, should've been in there already. The postmortem also flags that the existing playbook simply didn't include scenarios involving public code repositories or cloud secrets, a gap that's embarrassing in print.
Valadon noted that continuous scanning of public repositories caught this; a quarterly report would not have. We've tracked GitGuardian's work on secrets exposure across four stories at Threat Vectr, including our 11 July piece on dormant GitHub accounts used to map thousands of organisations, and the pattern holds: periodic checks leave months-long windows open. If a vendor's still selling you a quarterly scan, that's your answer.
Valadon also described the report as the first time a national cybersecurity agency has publicly called on organisations to make it easy to report leaks about themselves, not just about their products. Low bar, but CISA cleared it in public.
Operational takeaway: if your only leak-reporting channel is a product security form, you don't have a leak-reporting channel.
