Ars Technica

CSO Online

David Bombal

<h2>What happened</h2>
<p>A contractor working for CISA — the US government’s lead cybersecurity agency — maintained a public GitHub repository called “Private-CISA” that contained plaintext passwords, AWS GovCloud credentials, SSH private keys, authentication tokens, and Kubernetes configuration files. The repository sat open on the internet from at least November 2025 until mid-May 2026, roughly six months in total.</p>
<p>The files weren’t subtle. Names like <code>AWS-Workspace-Firefox-Passwords.csv</code> and <code>external-secret-repo-creds.yaml</code> made the contents immediately obvious to anyone who stumbled across them. The CSV file alone contained plaintext usernames and passwords for dozens of internal CISA systems, including its secure code development environment. In total, the repository held around 844 MB of sensitive data.</p>
<p>The contractor, an employee of Nightwing, appears to have been using the personal GitHub account to sync files between work and home computers. They had also deliberately disabled GitHub’s built-in secret detection feature.</p>
<h2>How it was found</h2>
<p>GitGuardian researcher Guillaume Valadon discovered the repository through automated public code scanning on May 14. He called it the worst leak he’d seen in his career. Security researchers from GitGuardian and Seralys both validated the credentials and confirmed they granted high-privilege access to three AWS GovCloud accounts, as well as access to CISA’s GitHub enterprise organization, including private repositories and CI/CD pipelines.</p>
<p>After the contractor failed to respond to responsible disclosure, Valadon brought the findings to journalist Brian Krebs. The repository was taken offline within a day of CISA being notified — but the exposed AWS keys remained valid for another 48 hours after that. TruffleHog creator Dylan Ayrey confirmed that a critical RSA private key stayed active for days after notification, and that other credentials tied to critical security technologies were still unrotated more than a week later.</p>
<h2>Why it matters</h2>
<p>This is embarrassing for any organization. For CISA, whose entire mandate is advising the rest of the US government and private sector on cybersecurity best practices, it’s something else entirely.</p>
<p>Cybercriminal groups and foreign intelligence services actively monitor GitHub’s public commit feed for exposed credentials. It’s automated, it’s constant, and it’s fast. Six months is a long time. Whether anyone actually harvested and used these credentials before the repository came down is still unclear — CISA says it found no evidence of compromise, but the agency is still investigating.</p>
<p>Congressional lawmakers from both chambers have demanded answers. The agency has been without a permanent director since January 2025 and has lost roughly a third of its workforce under the current administration. This follows a separate incident in January where acting CISA Director Madhu Gottumukkala uploaded sensitive government documents to ChatGPT, leading to his removal in February.</p>
<h2>The basic failures here</h2>
<p>This didn’t require a sophisticated attack. No zero-days, no nation-state tradecraft. The credentials were just sitting there, in plaintext, in a public repository, with obvious file names.</p>
<p>A few things that would have prevented this entirely:</p>
<ul>
<li><strong>Don’t store passwords in plaintext files.</strong> Use a password manager.</li>
<li><strong>Don’t use personal GitHub accounts for work files.</strong> Keep professional and personal developer environments separate.</li>
<li><strong>Don’t disable secret scanning.</strong> GitHub’s built-in detection exists for exactly this reason.</li>
<li><strong>Use short-lived credentials.</strong> Long-lived AWS keys that stay valid for days after a known exposure are a policy failure.</li>
<li><strong>Automate secret scanning across your organization.</strong> If GitGuardian’s automated scanner found this, CISA’s own tooling should have too.</li>
</ul>
<p>The repository also contained details about CISA’s internal software build, test, and deployment processes — the kind of information that makes follow-on attacks significantly easier even after the credentials are rotated.</p>
<p>CISA has pledged additional safeguards. Given the circumstances, that’s the least one would expect.</p>


Collections

A contractor working for CISA maintained a public GitHub repository named 'Private-CISA' containing plaintext passwords, AWS GovCloud credentials, SSH private keys, authentication tokens, and Kubernetes config files for roughly six months. The repository held ~844 MB of sensitive data with obviously named files. GitGuardian researcher Guillaume Valadon discovered it via automated scanning on May 14, confirmed credentials granted high-privilege access to three AWS GovCloud accounts and CISA's GitHub enterprise org. After responsible disclosure was ignored, journalist Brian Krebs was contacted, and the repo came down within a day — but exposed AWS keys remained valid for 48 more hours, and a critical RSA private key stayed active for days. The contractor had deliberately disabled GitHub's built-in secret scanning and was using a personal account to sync work files. CISA, whose mandate is advising the US government on cybersecurity, has pledged additional safeguards. Basic preventive measures — password managers, separate work/personal accounts, secret scanning, short-lived credentials — would have prevented the incident entirely.

CISA contractor left AWS GovCloud credentials and plaintext passwords in a public GitHub repo for six months

<p>The rate of critical infrastructure vulns and the stupidity of them is getting pretty ridiculous.</p>
