CISA's GitHub Credentials Leak Exposes Critical Gaps in Incident Response

The Cybersecurity and Infrastructure Security Agency has published findings from an incident in which a contractor inadvertently committed dozens of sensitive credentials to a public GitHub repository. The exposure persisted for nearly half a year before CISA received notification from KrebsOnSecurity, and security researchers say the agency's delayed response reveals lessons applicable across the industry.

On May 15, 2026, GitGuardian alerted CISA to a publicly accessible GitHub repository labeled "Private CISA" containing 844 MB of agency data. Among the compromised materials were files such as "importantAWStokens," which held administrative credentials for three Amazon AWS GovCloud instances, and "AWS-Workspace-Firefox-Passwords.csv," exposing plaintext login credentials for numerous internal CISA systems.

Although CISA acknowledged the initial notification promptly, the agency required more than 48 hours to revoke the AWS keys and other exposed secrets. In its postmortem analysis, CISA attributed the extended timeline to the intricate nature of its infrastructure and interconnected relationships with federal and industry partners, which complicated the key rotation process.

"Drawing on this experience, CISA encourages others to maintain mature and well-tested key management capabilities," the report states.

Reporting Channels and External Communication

CISA acknowledged shortcomings in how it handles security incident notifications originating from external researchers. The postmortem emphasizes that organizations must establish distinct communication pathways to differentiate between incidents affecting their own infrastructure and those impacting their products or customer base.

Preston Werntz and Brad Libbey, serving as acting chief information officer and acting chief information security officer respectively, noted in their analysis: "In CISA's case, these channels were not well defined, leading the security researcher to try multiple avenues – including emailing the contractor, submitting through CISA's vulnerability disclosure platform (which is intended for vulnerabilities impacting the broader cybersecurity community), and ultimately involving a reporter."

Going forward, CISA intends to streamline its reporting mechanisms to facilitate faster and easier communication from researchers. The agency's leadership further recommended that organizations supplement security.txt files with reporting instructions displayed across multiple visible channels.

Missed Automated Alerts

Guillaume Valadon, the GitGuardian researcher who initiated contact with KrebsOnSecurity regarding the exposed CISA materials, revealed that CISA had disregarded nine automated notifications about the credentials prior to the May 15 alert. GitGuardian continuously monitors public code repositories for exposed secrets and automatically notifies affected accounts.

"Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure," Valadon wrote in response to CISA's report. "Make it trivial to report a leak about you, not just about your products. The person reporting a leak to you is not the threat. Publish a security.txt, but do not stop there. Put reporting instructions in several prominent places, and make sure a report about your own infrastructure does not land in a product-bug queue."

Continuous Monitoring and Secret Management

CISA's postmortem underscores the necessity of continuously scanning public repositories for exposed secrets rather than conducting periodic reviews. The agency has since rotated all compromised secrets and developed an action plan to enhance developer secret management and strengthen ongoing monitoring practices.

The report revealed that while CISA maintained a playbook for responding to cybersecurity incidents, it lacked specific procedures for situations involving GitHub and comparable cloud services. Valadon emphasized that the postmortem validates the case for constant surveillance: "The Private-CISA repository sat public for six months. Continuous monitoring of public GitHub surfaced it. Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building."

Positive Security Measures

CISA identified several areas where existing security practices proved effective in managing the incident's scope and consequences. Enhanced logging infrastructure and implementation of zero-trust architecture across both production and development environments enabled the agency to verify that no customer or mission-critical data had been compromised and that the exposed credentials remained unused outside CISA's systems. The contractor responsible for the exposure had their system access immediately terminated.

Industry Implications

Valadon highlighted the postmortem itself as the most significant contribution, commending CISA for its candor regarding both successes and failures. "To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers," Valadon observed. "That is exactly the incident communication we should expect from every organization."

Source: Krebs on Security