CISA published a postmortem on a data leak where a contractor exposed 844 MB of sensitive credentials — including AWS GovCloud keys and plaintext passwords — in a public GitHub repository for nearly six months. GitGuardian sent nine automated alerts that went unanswered before KrebsOnSecurity intervened. Key lessons include: maintaining mature key rotation capabilities, establishing clear incident reporting channels separate from product vulnerability disclosure, and continuously scanning public code repositories for exposed secrets rather than relying on periodic audits. CISA's zero-trust logging helped confirm no customer data was accessed. GitGuardian's Guillaume Valadon praised CISA's transparency, calling it the first time a national cybersecurity agency publicly advocated for secrets scanning and simplified researcher relations.
