CISA and the GitHub Credential Leak: Six Months of Exposure and a Failed Reporting System

Introduction

The Cybersecurity and Infrastructure Security Agency (CISA), the U.S. federal agency tasked with protecting the nation’s critical infrastructure, has been at the center of a serious internal security incident. An external contractor published approximately 844 MB of sensitive data to a public GitHub repository, including administrative keys to government cloud servers and plaintext passwords. The exposure remained active for over six months, despite nine automated alerts from the GitGuardian scanning system, and was only resolved after direct intervention by investigative journalist Brian Krebs. The episode, though without actual compromise, illustrates in a striking way how even the flagship organization for cybersecurity can stumble due to inadequate internal processes.

Technical Analysis

The offending repository, tellingly named “Private CISA,” contained unprotected internal files totaling 844 MB. In particular, it exposed:

• Administrator credentials for three AWS GovCloud servers, the cloud platform dedicated to U.S. government workloads;
• A CSV file containing dozens of plaintext usernames and passwords for internal CISA systems.

GitGuardian, the secret scanning service used by the agency, had detected the leak and sent nine notifications over the six-month period. Unfortunately, these alerts landed in an inadequate reporting channel, likely associated with product vulnerability processes, and went unanswered. The situation was unlocked in May 2026, when Brian Krebs (KrebsOnSecurity) — after analyzing the repository — personally contacted CISA leadership.

Containment took more than 48 hours from notification: an unusually long time, driven by the need to safely rotate all compromised keys and manage the numerous interconnections with federal and industry partners that shared those credentials. The subsequent investigation, supported by extensive logging and an already-active zero-trust architecture, was able to rule out any unauthorized external access, confirming that no mission or customer data had been breached.

Impact

Although there was no immediate material damage, the potential risk was assessed as “high”: administrative keys to government environments could have been exploited to move laterally within federal infrastructure or exfiltrate sensitive data.

The most immediate impact was reputational. The agency that writes the guidelines for national cybersecurity protection showed elementary vulnerabilities — plaintext passwords on a public repo — and, even more seriously, revealed the lack of an effective channel for reports concerning its own internal security. The emergency credential rotation also caused a significant operational slowdown, consuming resources and work hours to restore full operation.

Mitigation

CISA published a transparent post-mortem analysis and issued several recommendations, applicable well beyond the government perimeter:

• Continuous and Integrated Scanning: Secret detection systems (such as GitGuardian) must generate alerts that are funneled directly into incident response workflows, with metrics for acknowledgment and immediate response.
• Separate and Visible Reporting Channels: There must be a clear distinction between contact points for product vulnerabilities and those for internal incidents. Instructions should be published on security.txt, on corporate portals, and on every public interface, with processes that prevent misrouting.
• Fast and Automated Key Rotation: Credential revocation and renewal plans must be tested regularly and must include scenarios involving external partners, in order to reduce reaction times.
• Dedicated Playbooks: Define specific procedures for credential leaks on platforms like GitHub, integrating them into the incident management system.
• Zero‑Trust and Extensive Logging: The zero-trust architecture proved effective in containing the incident. Extending activity logging and enforcing least-privilege principles remains a crucial defense.
• Mandatory Contractor Training: External collaborators must be contractually bound to protect secrets and trained on code publication policies, with automated checks before any public commit.

FAQ

1. How was the incident discovered, given that GitGuardian had already sent several alerts?
Although GitGuardian generated nine notifications over six months, those reports were not acted upon because they were routed to a channel designed for product vulnerabilities, not for internal incidents. Actual awareness only occurred when journalist Brian Krebs manually reported the repository to CISA leadership.

2. Were there any unauthorized accesses to the AWS GovCloud servers or other CISA systems?
According to the investigations carried out with the help of logs and zero-trust controls, no abusive external access was detected. Mission data and customer information remained intact. However, the six‑month window could have allowed an attacker to move undetected, had the containment measures not been in place.

3. What will change at CISA after this incident?
The agency has completely overhauled its external reporting intake system, separating the flows dedicated to product vulnerabilities from those for internal emergencies. It has also strengthened automatic scanning policies, introduced GitHub‑specific playbooks, and mandated more rigorous training for contractors to prevent the accidental publication of sensitive data.