CISA Contractor's Public GitHub Repo Spilled GovCloud Keys for Months; Lawmakers Want Answers

A contractor working for the U.S. Cybersecurity and Infrastructure Security Agency published AWS GovCloud access keys, an RSA private key for a GitHub App installed on the CISA-IT organization, and dozens of other plaintext secrets to a public GitHub profile named "Private-CISA" that has been live since November 2025. The repo was flagged to CISA by GitGuardian more than a week before the agency began invalidating the exposed material, and rotation is still incomplete.

Commit logs reviewed by outside researchers show the contractor explicitly disabled GitHub's push protection — the built-in scanner that blocks commits containing recognised secret formats. The pattern of commits looks less like a curated project and more like an individual using a public repo as a scratchpad to sync files between a work machine and a home machine. That is the part no DLP product was ever going to catch.

How the leak compounds

The most damaging artefact was not an AWS key. Dylan Ayrey, creator of TruffleHog and founder of Truffle Security, said the repo contained an RSA private key for a GitHub App owned by the CISA enterprise account and installed on the CISA-IT GitHub organisation with full access to every repository. With that key, an attacker can read source from every private repo in CISA-IT, register rogue self-hosted runners to hijack CI/CD pipelines, exfiltrate repository secrets, and rewrite branch protection rules, webhooks and deploy keys. That is a supply-chain foothold inside the agency that writes the federal supply-chain guidance.

Ayrey said CISA appears to have invalidated the RSA key shortly after he reported it on May 20, but credentials tied to several other security technologies deployed across the agency remain unrotated. Truffle Security's monitoring suggests the most sensitive material landed in the repo in late April 2026. Adversaries watch the same public GitHub events firehose that defenders do. "Anyone monitoring GitHub events could be sitting on this information," Ayrey said.

CISA's written statement says there is "no indication that any sensitive data was compromised." It does not address how long the secrets were exposed.

Congress weighs in

In a May 19 letter to Acting Director Nick Andersen, Sen. Maggie Hassan (D-NH) put a dozen questions to the agency about internal controls. Rep. Bennie Thompson (D-MS), ranking member on House Homeland Security, and Rep. Delia Ramirez (D-Ill) co-signed a parallel letter arguing the incident "reflects a diminished security culture" and noting that the Private-CISA contents offered foreign services "the information, access, and roadmap" to persist on federal networks.

The political backdrop matters. CISA has lost more than a third of its workforce and nearly all of its senior leaders to early retirements, buyouts and resignations under the current administration. Push protection can be enforced at the enterprise level. A contractor pushing agency secrets to a personal account cannot.

And the GitHub App key was only the loudest of the exposed credentials. The quieter ones are still being rotated.