CISA GitHub Leak: Critical Lessons From Exposed AWS GovCloud Keys

When a contractor published a public GitHub repository called “Private CISA” on May 15, 2026, it exposed 844 MB of sensitive agency data—including administrative credentials to three Amazon AWS GovCloud servers and a plaintext CSV titled “AWS-Workspace-Firefox-Passwords.csv” listing usernames and passwords for dozens of internal CISA systems. GitGuardian researcher Guillaume Valadon first alerted KrebsOnSecurity after his team’s automated scanners had fired off nine prior notification emails to CISA that went entirely unanswered. The lapse illustrates how a single contractor mistake, combined with weak intake processes, can leave production cloud credentials exposed for nearly six months. Security teams can run their own exposure baseline with a password checker and a email breach checker to identify whether employee credentials are circulating in public repositories.

CISA acknowledged the alert quickly but took more than 48 hours to invalidate the leaked AWS keys and rotate the remaining secrets, citing system complexity and interconnections with federal and industry partners. In its postmortem, acting CIO Preston Werntz and acting CISO Brad Libbey admitted the agency’s reporting channels were poorly defined, forcing Valadon to email the contractor directly, submit through CISA’s vulnerability disclosure platform (designed for community-reported vulnerabilities rather than agency compromises), and ultimately escalate through a journalist. “Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure,” the findings underscore, making automated triage of inbound security alerts a non-negotiable control. Teams should validate that their own secrets-detection, alerting, and rotation workflows function under load using a privacy checkup and periodic tabletop exercises.

The broader lessons are clear: organizations must maintain mature, well-tested key management capabilities with documented rotation runbooks; publish reporting instructions in multiple prominent locations rather than relying solely on security.txt; and separate inbound channels for product or customer vulnerabilities from those affecting internal infrastructure. CISA has committed to refining its intake process to make it faster and easier for external researchers to reach the right team. For defenders, the incident is a reminder that the gap between detection and containment—not the detection itself—is often what turns a credential leak into a full-scale breach.