A contractor for the Cybersecurity and Infrastructure Security Agency (CISA) exposed highly privileged credentials to multiple AWS GovCloud accounts and a wide range of internal CISA systems by maintaining a public GitHub repository, an incident security researchers describe as one of the most egregious government data leaks in recent history. The repository, named “Private-CISA,” contained cloud keys, tokens, plaintext passwords, logs, and internal documentation detailing how the agency builds, tests, and deploys software.
CISA Contractor’s Public GitHub Repository Exposed AWS GovCloud Credentials
Guillaume Valadon, a security researcher at GitGuardian, identified the exposed repository during the company’s routine scanning of public code repositories for secrets. GitGuardian’s platform automatically alerts account holders when sensitive data is detected, but in this case, the account owner was not responding. Valadon reached out after recognizing the extreme sensitivity of the exposed information.
The repository’s commit logs revealed that the CISA contractor had deliberately disabled GitHub’s default setting that blocks users from publishing SSH keys and other secrets in public repositories. “I honestly believed that it was all fake before analyzing the content deeper,” Valadon said. “This is indeed the worst leak that I’ve witnessed in my career.”
What Was Leaked: GovCloud Administrative Keys and Plaintext System Passwords
Among the exposed files was “importantAWStokens,” which contained administrative credentials for three Amazon AWS GovCloud servers. Another file, “AWS-Workspace-Firefox-Passwords.csv,” listed plaintext usernames and passwords for dozens of internal CISA systems, including “LZ-DSO” (Landing Zone DevSecOps), the agency’s secure code development environment.
Security consultant Philippe Caturegli, founder of Seralys, validated that the exposed credentials could authenticate to three AWS GovCloud accounts at a high privilege level. He also identified plaintext credentials to CISA’s internal “artifactory” — a repository of code packages used for software development. “That would be a prime place to move laterally,” Caturegli warned. “Backdoor in some software packages, and every time they build something new they deploy your backdoor left and right.”
The repository also revealed poor password practices: many internal resources used passwords consisting of the platform name followed by the current year. Caturegli noted that even without external exposure, such practices represent a serious security threat, as threat actors often leverage weak internal credentials after gaining initial access to a network.
CISA’s Response and the Contractor Profile
A CISA spokesperson confirmed the agency is investigating the exposure, stating that “currently, there is no indication that any sensitive data was compromised as a result of this incident.” The spokesperson added that the agency is working to implement additional safeguards. The repository was taken offline after notification, though Caturegli noted that the exposed AWS keys remained valid for another 48 hours.
The contractor responsible for the repository was an employee of Nightwing, a government contractor based in Dulles, Virginia. The “Private-CISA” repository was created on November 13, 2025, and the contractor’s GitHub account dated back to September 2018. Nightwing declined to comment, directing inquiries to CISA.
Caturegli assessed that the contractor was likely using the GitHub repository to synchronize files between a work laptop and a home computer. The use of both a CISA-associated email address and a personal email address in the repository’s metadata supports this theory. “This would be an embarrassing leak for any company, but it’s even more so in this case because it’s CISA,” he said.
The incident comes at a particularly challenging time for the agency, which has lost nearly a third of its workforce since the beginning of the second Trump administration due to early retirements, buyouts, and resignations.
How Organizations Can Prevent Credential Exposures on Public Repositories
This incident underscores the critical importance of automated secrets detection in code repositories. Organizations should deploy a dedicated secrets scanning solution that continuously monitors public and private repositories for exposed credentials, API keys, and tokens. Such tools should be configured to alert security teams immediately and, where possible, automatically revoke exposed credentials.
Beyond tooling, strict policies around repository classification are essential. No internal or sensitive credentials should ever be committed to a repository that is not explicitly private and restricted. Developers should use environment variables, vault solutions, or a zero-knowledge secrets manager to handle credentials securely, rather than embedding them in code or configuration files. Multi-factor authentication and session monitoring for all cloud administration accounts provide an additional critical layer of defense.
For organizations subject to federal or regulatory compliance requirements, regular audits of version control systems and continuous integration pipelines should be standard practice. The combination of technical controls, staff training, and periodic security reviews is the most effective defense against this class of exposure.
