The Cybersecurity and Infrastructure Security Agency (CISA) has issued a candid postmortem on a significant data leak incident that saw dozens of internal CISA credentials, including critical AWS GovCloud keys, inadvertently exposed in a public GitHub repository for nearly six months. This prolonged exposure was only brought to light after KrebsOnSecurity was notified by security firm GitGuardian. The agency’s subsequent analysis highlights critical shortcomings in its initial response and offers invaluable lessons for all security teams grappling with similar challenges.

The incident, which came to light on May 15, 2026, involved a public GitHub repository titled "Private CISA." Security researcher Guillaume Valadon of GitGuardian, whose company specializes in detecting exposed secrets in code, requested assistance from KrebsOnSecurity to notify CISA about the repository. This repository contained a staggering 844 MB of sensitive CISA-related data. Among the most alarming exposed files were "importantAWStokens," which held administrative credentials for three Amazon AWS GovCloud servers, and "AWS-Workspace-Firefox-Passwords.csv," a file containing plaintext usernames and passwords for numerous internal CISA systems.

While CISA acknowledged the initial alert, its response to invalidate the compromised credentials and other secrets was notably slow, taking over 48 hours. In its official report on the data leak, CISA attributed this delay to the inherent complexities of the agency’s interconnected systems and their integration with federal and industry partners, stating that key rotation proved more time-consuming than initially anticipated. The report pragmatically advises organizations to "maintain mature and well-tested key management capabilities," a direct takeaway from this experience.

Beyond technical complexities, CISA’s postmortem also acknowledges significant areas for improvement in its incident response procedures, particularly concerning notifications from external parties. The agency stressed the critical need for clearly defined and distinct reporting channels to ensure that incidents affecting the organization itself are handled with the urgency and priority they deserve, differentiating them from issues impacting CISA’s products or customers.

Preston Werntz, acting chief information officer, and Brad Libbey, acting chief information security officer at CISA, authored the analysis, detailing how the lack of well-defined channels led to confusion. The security researcher initially attempted to report the leak through multiple avenues, including contacting the contractor directly, submitting a report through CISA’s vulnerability disclosure platform (which is designed for vulnerabilities affecting the broader cybersecurity community), and ultimately involving a journalist. This fragmented approach highlights a critical communication gap.

CISA has pledged to refine its reporting channels, aiming to make them more accessible and efficient for security researchers. The agency’s authors emphasized that while the security.txt file is a common tool, organizations should also publish reporting instructions in other prominent locations to ensure clarity and accessibility.

Guillaume Valadon, the GitGuardian researcher who first flagged the exposed credentials, pointed out a concerning detail: CISA had reportedly ignored nine automated alerts regarding the exposed credentials prior to the May 15 notification. GitGuardian’s systems continuously scan public code repositories for exposed secrets and automatically notify the respective accounts. Valadon’s analysis starkly illustrates the consequence: "Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." He strongly advocates for making it "trivial to report a leak about you, not just about your products." His advice echoes the importance of publishing a security.txt file but extends it to placing reporting instructions in multiple visible locations, ensuring that reports about an organization’s own infrastructure are not mistakenly routed to product bug queues.

The report’s authors also underscored the imperative of continuous scanning of public code repositories like GitHub for exposed secrets. CISA has since undertaken a comprehensive secret rotation and established an action plan to enhance the management and monitoring of developer secrets moving forward. A key finding from the postmortem was that CISA’s existing incident response playbook, while comprehensive for general cybersecurity incidents, lacked specific guidance for scenarios involving GitHub or other cloud services. Valadon’s commentary validates the need for continuous, rather than quarterly, scanning for exposed secrets, emphasizing that "The Private-CISA repository sat public for six months… Continuous monitoring of public GitHub surfaced it. Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building."

Despite the significant leak, CISA awarded itself passing grades in several areas of security preparedness that facilitated its assessment of the incident’s scope and impact. These included its enhanced logging capabilities and the adoption of zero-trust principles across its production and development systems. CISA stated that these detailed logs enabled them to definitively confirm that no customer or mission data was compromised and that the leaked credentials were not utilized outside of CISA’s internal environments. The contractor responsible for the exposure had their system access promptly revoked.

Valadon identified CISA’s transparency in its postmortem as the most significant takeaway, commending the agency for openly discussing both its successes and failures. He remarked, "To my knowledge, it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers. That is exactly the incident communication we should expect from every organization." This open acknowledgment and proactive approach to learning from a breach position CISA as a model for other organizations navigating the complex landscape of cybersecurity incident response and researcher engagement.