Pradipta eManuel
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a candid postmortem detailing a significant data leak that exposed dozens of internal credentials, including critical AWS GovCloud keys, on a public GitHub repository for an alarming six months before being detected by KrebsOnSecurity. This incident, and CISA’s subsequent analysis, offers a crucial roadmap of lessons for all organizations regarding incident response, vulnerability disclosure, and the imperative of robust secrets management. The breach underscores the persistent challenges in securing sensitive information in an increasingly complex digital landscape and highlights the vital role of external security researchers and proactive internal security measures.
The gravity of the situation became apparent on May 15, 2026, when GitGuardian, a prominent security firm specializing in code security, reached out for assistance in notifying CISA about a public GitHub repository provocatively named "Private CISA." This repository contained a substantial 844 MB of sensitive CISA-related data. Among the exposed files were "importantAWStokens," which held administrative credentials for three Amazon AWS GovCloud servers, and "AWS-Workspace-Firefox-Passwords.csv," a file detailing plaintext usernames and passwords for numerous internal CISA systems. The exposure of such credentials could have had catastrophic implications, potentially granting unauthorized access to critical government infrastructure and sensitive data.
CISA’s initial response, while acknowledging the alert, was notably slow. It took over 48 hours to invalidate the compromised AWS keys and other critical secrets. In its official report on the incident, CISA attributed this delay to the "complexities of the agency’s systems and interconnections with federal and industry partners," which prolonged the key rotation process beyond what would be considered ideal in a swift incident response. This explanation emphasizes the interconnected nature of modern IT infrastructure, where even a seemingly straightforward task like rotating credentials can become a complex undertaking due to dependencies and legacy systems. CISA’s report explicitly encourages other organizations to "maintain mature and well-tested key management capabilities," a clear directive stemming from this painful experience.
Beyond technical challenges, CISA’s postmortem also sheds light on significant shortcomings in its incident reporting channels. The agency admitted that its existing procedures were not adequately defined for handling notifications about internal security incidents. This lack of clarity led the security researcher, Guillaume Valadon of GitGuardian, to attempt multiple avenues for reporting the leak, including direct contact with the contractor responsible for the leak, submitting through CISA’s vulnerability disclosure platform (intended for vulnerabilities affecting the broader cybersecurity community), and ultimately, engaging KrebsOnSecurity to bring the issue to CISA’s attention.
The report, authored by Preston Werntz and Brad Libbey, CISA’s acting chief information officer and acting chief information security officer respectively, stressed the critical need for "clear and distinct reporting channels" that differentiate between incidents affecting the organization itself and those impacting its products or customers. This distinction is crucial for ensuring that internal security threats receive the immediate and appropriate attention they deserve, rather than being misrouted to product support or development queues. CISA has since committed to refining its reporting channels to be more accessible and efficient for researchers, recognizing that simplifying the process of reporting security issues is paramount. The agency also noted that while the security.txt file is a valuable tool, organizations should consider publishing reporting instructions in multiple prominent locations to maximize visibility.
The sheer volume of ignored automated alerts prior to KrebsOnSecurity’s intervention is a stark indictment of CISA’s internal processes. Guillaume Valadon revealed that GitGuardian had sent nine automated alerts about the exposed credentials before CISA was officially notified. GitGuardian’s automated systems continuously scan public code repositories for exposed secrets, promptly alerting the offending accounts. Valadon’s analysis poignantly stated, "Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." He underscored the need to make it "trivial to report a leak about you, not just about your products." Valadon’s advocacy for a robust security.txt file, coupled with additional prominent reporting instructions and a dedicated channel for infrastructure security reports, resonates as a best practice for all organizations.
The report also emphasized the critical importance of continuous scanning of public code repositories for exposed secrets. CISA has since implemented a comprehensive plan to rotate all compromised secrets and enhance its monitoring capabilities. The incident revealed that CISA’s existing playbook for cybersecurity incidents did not specifically address scenarios involving GitHub or other cloud services, highlighting a critical gap in their preparedness. Valadon’s assertion that continuous scanning, rather than quarterly checks, is essential is powerfully illustrated by the fact that the "Private-CISA" repository remained public for six months. He suggested that more comprehensive internal scanning could have identified and remediated the committed plaintext passwords and backups long before they were exfiltrated.
Despite the significant issues, CISA did report successes in certain areas, which helped in assessing the scope and impact of the leak. Enhanced logging capabilities and the adoption of zero-trust principles in both production and development systems allowed CISA to confidently assert that no customer or mission data was compromised and that the leaked credentials were not used outside of CISA’s environments. The agency also confirmed that the contractor responsible for the leak had their system access revoked. These elements demonstrate the value of existing security investments, even in the face of an incident.
Ultimately, Valadon identified CISA’s transparent postmortem as the most significant takeaway from the incident. He commended the agency for its candor in discussing both what worked and what did not. "To my knowledge," Valadon wrote, "it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers. That is exactly the incident communication we should expect from every organization." CISA’s willingness to publicly dissect its own failures and offer actionable insights sets a commendable standard for transparency and continuous improvement in cybersecurity incident response, providing invaluable lessons for governmental agencies, private companies, and security researchers alike.
