The Cybersecurity and Infrastructure Security Agency (CISA) has released a postmortem examining its response to a significant data leak in which a contractor exposed dozens of internal credentials — including administrative keys for three Amazon AWS GovCloud servers — on a public GitHub repository for nearly six months. The report identifies critical gaps in the agency’s incident response process that offer broader lessons for security teams managing cloud infrastructure and developer secrets.
How the CISA GitHub Credential Leak Was Discovered
On May 15, 2026, security firm GitGuardian contacted KrebsOnSecurity for assistance in notifying CISA about a public GitHub repository named “Private CISA” that contained 844 MB of sensitive agency data. Among the exposed files was “importantAWStokens,” which held administrative credentials for three AWS GovCloud servers, and “AWS-Workspace-Firefox-Passwords.csv,” a plaintext file listing usernames and passwords for numerous internal CISA systems. GitGuardian researcher Guillaume Valadon reported that the agency had ignored nine automated alerts about the exposed credentials prior to external notification, allowing what could have been a one-day incident to persist for half a year.
Key Failures in CISA’s Incident Response
CISA acknowledged the initial alert quickly but took more than 48 hours to invalidate the exposed AWS keys and other critical secrets. In its official report, authored by acting Chief Information Officer Preston Werntz and acting Chief Information Security Officer Brad Libbey, the agency attributed the delay to the complexity of its systems and interconnections with federal and industry partners. The report emphasizes that organizations should maintain mature and well-tested key management capabilities.
The postmortem also reveals that CISA’s reporting channels for external security notifications were poorly defined. Researchers attempting to report the leak faced confusion over whether to contact the contractor directly, submit through CISA’s vulnerability disclosure platform — which is designed for vulnerabilities affecting the broader cybersecurity community, not the agency itself — or involve a journalist. CISA acknowledged that clear and distinct reporting channels are essential to ensure incidents affecting the organization are handled separately from those involving its products or customers.
What Should Organizations Do to Prevent Similar Exposures?
Organizations should implement continuous scanning of public code repositories for exposed secrets, rather than relying on periodic quarterly reviews. CISA’s own playbook for cybersecurity incidents did not include procedures for responding to exposures involving GitHub or other cloud services, a gap the agency has since begun to address. Security teams should ensure that incident response playbooks explicitly cover cloud-based credential leaks and that reporting channels for external researchers are clearly published in multiple prominent locations, not just in a security.txt file.
The Role of Secrets Scanning and Zero Trust
CISA credited its enhanced logging capabilities and adoption of zero-trust principles in production and development systems for helping the agency determine that no customer or mission data was compromised and that the leaked credentials were not used outside CISA’s environments. The contractor who exposed the secrets had their system access revoked. However, the agency conceded that comprehensive internal scanning could have caught the plaintext passwords and committed backups before the data ever left its networks.
Why CISA’s Transparency Matters for the Security Community
Valadon noted that the CISA postmortem is likely the first instance of a national cybersecurity agency publicly advocating for secrets scanning and for simplifying relationships with security researchers. The report validates that continuous monitoring — not quarterly checks — is essential for surfacing exposed credentials in public repositories. CISA has since rotated all secrets and developed an action plan to improve management of developer secrets and monitoring going forward.
What Affected Users and Security Teams Should Do Now
For security teams, the immediate takeaway is to audit incident response playbooks to ensure they cover cloud credential leaks, publish clear and distinct reporting channels for external researchers, and implement continuous scanning of public code repositories for exposed secrets. Organizations should also adopt a zero-trust architecture with comprehensive logging to rapidly assess the scope of any exposure. For individuals concerned about similar incidents, enabling multi-factor authentication on all accounts, using a reputable password manager that generates unique credentials for each service, and monitoring financial and account activity for signs of unauthorized access are prudent steps. The most critical action is to ensure that your organization treats reports from external security researchers as a priority, not an afterthought — because a missed notification can turn a one-day incident into a six-month exposure.
