CISA Postmortem Reveals Critical Lessons from GitHub Credential Leak
A CISA postmortem details lessons learned from a contractor's exposure of internal credentials, including AWS Govcloud keys, on GitHub for six months.
The Cybersecurity and Infrastructure Security Agency (CISA) has released a detailed postmortem report addressing a significant data leak where a contractor inadvertently exposed numerous internal credentials, including sensitive AWS Govcloud keys, on a public GitHub repository. The exposure persisted for nearly six months before being identified by KrebsOnSecurity. The agency's analysis highlights critical takeaways regarding mature key management practices, the necessity of well-defined incident notification channels, and the importance of continuous scanning for exposed secrets in public repositories.
The incident came to light when the security firm GitGuardian alerted CISA on May 15, 2026, to a public GitHub repository named "Private CISA." This repository contained 844 MB of sensitive data, including administrative credentials for three Amazon AWS GovCloud servers and plaintext usernames and passwords for dozens of internal CISA systems. Despite the initial alert, CISA took over 48 hours to invalidate the compromised AWS keys and other sensitive secrets, citing the complexity of its systems and interconnections with federal and industry partners as reasons for the delay in key rotation.
In its report, CISA emphasized the need for organizations to maintain "mature and well-tested key management capabilities." The agency also acknowledged shortcomings in its incident response process, particularly concerning notifications from external security researchers. The postmortem stresses the importance of establishing clear and distinct reporting channels to differentiate between incidents affecting the agency's own infrastructure and those impacting its products or customers.
According to the analysis by Preston Werntz and Brad Libbey, CISA's acting CIO and CISO respectively, the security researcher initially attempted to notify CISA through multiple avenues, including direct email to the contractor, CISA's vulnerability disclosure platform, and ultimately involving a reporter. This lack of a well-defined channel led to delays in remediation.
Guillaume Valadon, the GitGuardian researcher who discovered the leak, noted that CISA had ignored nine automated alerts about the exposed credentials prior to the KrebsOnSecurity notification. GitGuardian continuously scans public code repositories for exposed secrets and automatically alerts the responsible accounts. Valadon stated, "Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." He urged organizations to make it easy to report leaks concerning their own infrastructure, not just their products, and to ensure such reports are routed appropriately.
The CISA report also underscored the critical need for continuous scanning of public code repositories like GitHub for exposed secrets. The agency has since rotated all compromised secrets and developed an action plan to enhance the management and monitoring of developer secrets. Notably, CISA's existing incident response playbook did not explicitly cover scenarios involving GitHub or other cloud services, a gap that has now been addressed.
Despite the exposure, CISA reported that its enhanced logging capabilities and adoption of zero-trust principles allowed it to confirm that no customer or mission data was compromised and that the leaked credentials were not used outside of CISA's environments. The contractor responsible for the leak had their system access revoked.
Valadon praised CISA for its transparency in the postmortem report, calling it a valuable example for other organizations. He highlighted that this is likely the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying interactions with security researchers, setting a benchmark for incident communication.