The Cybersecurity and Infrastructure Security Agency (CISA) has issued a candid postmortem detailing a significant data leak incident where a contractor inadvertently exposed dozens of internal CISA credentials, including critical AWS GovCloud keys, in a public GitHub repository. This sensitive information remained accessible for nearly six months before being brought to light by KrebsOnSecurity. The agency’s self-assessment identifies crucial shortcomings in its initial response and operational procedures, offering vital lessons that security teams across all sectors should meticulously absorb to fortify their own defenses.

The incident, which came to light on May 15, 2026, began when the security firm GitGuardian alerted CISA to the existence of a public GitHub repository starkly titled "Private CISA." This repository contained a substantial 844 MB of CISA-related data. Among the exposed files were "importantAWStokens," which held administrative credentials for three Amazon AWS GovCloud servers, and "AWS-Workspace-Firefox-Passwords.csv," a file containing dozens of CISA internal system usernames and passwords in plaintext. The prolonged exposure period underscores a critical failure in both automated detection and timely incident response.

While CISA acknowledged KrebsOnSecurity’s initial alert, the agency’s response to invalidate the compromised AWS keys and other critical secrets extended beyond the expected 48-hour window. In its official report on the data leak, CISA attributed this delay to the inherent complexities of its intricate systems and their interconnectedness with various federal and industry partners. This complexity, the agency stated, significantly complicated the process of rotating compromised keys. The report emphatically encourages all organizations to cultivate "mature and well-tested key management capabilities" to prevent similar occurrences.

Furthermore, CISA candidly admitted that its procedures for handling security incident notifications from external parties require substantial improvement. The postmortem highlights the critical necessity of establishing clear and distinct reporting channels. These channels, the agency argues, are essential to differentiate between incidents affecting the organization’s own infrastructure and those pertaining to its products or customers. The report, authored by Preston Werntz, CISA’s acting chief information officer, and Brad Libbey, its acting chief information security officer, pointed out that in this instance, the reporting channels were poorly defined. This ambiguity led the security researcher to pursue multiple avenues, including direct contact with the contractor, submission through CISA’s vulnerability disclosure platform (which is intended for broader community-impacting vulnerabilities), and ultimately, the involvement of a reporter.

In response to these identified weaknesses, CISA is actively refining its reporting mechanisms to render them more accessible and efficient for security researchers. The agency’s authors also noted that while many researchers rely on the security.txt file for reporting vulnerabilities, organizations can enhance clarity by publishing these reporting instructions in multiple, prominently visible locations. This multi-pronged approach ensures that critical notifications are less likely to be overlooked.

Guillaume Valadon, the GitGuardian researcher who initially flagged the exposed CISA credentials to KrebsOnSecurity, revealed that CISA had overlooked nine automated alerts regarding the exposed credentials prior to the May 15 notification. GitGuardian’s platform continuously scans public code repositories like GitHub for exposed secrets, automatically notifying account holders of any apparent sensitive data exposures. Valadon’s analysis of CISA’s report emphasizes that "letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." He stressed the importance of making it "trivial to report a leak about you, not just about your products." Valadon’s advice strongly advocates for publishing a security.txt file, but importantly, not stopping there. He urges organizations to place reporting instructions in several prominent locations and to ensure that reports concerning their own infrastructure are not mistakenly routed to product-bug queues.

The CISA report also underscored the paramount importance of continuous scanning of public code repositories for exposed secrets. The agency has since undertaken a comprehensive rotation of all compromised secrets and has developed an action plan aimed at enhancing the management of developer secrets and improving ongoing monitoring efforts. The report revealed that while CISA possessed a playbook for cybersecurity incident response, it notably lacked specific protocols for situations involving GitHub or other cloud services. Valadon’s assessment aligns with this, reinforcing the necessity of continuous, rather than quarterly, scanning for exposed secrets. He pointed out that the "Private-CISA" repository remained public for six months, a duration that continuous monitoring of public GitHub would have significantly shortened. Furthermore, he posited that comprehensive internal scanning could have detected the plaintext passwords and committed backups long before they were inadvertently exposed externally.

Despite the significant data leak, CISA awarded itself passing grades in several areas of security preparedness that proved instrumental in assessing the scope and impact of the exposed secrets. These included enhanced logging capabilities and the adoption of zero-trust principles across its production and development systems. The agency stated that its detailed logs enabled it to conclusively demonstrate that no customer or mission data was compromised and that the leaked credentials were not utilized outside of CISA’s internal environments. The contractor responsible for the exposure had their system access immediately revoked.

Valadon identified CISA’s transparent postmortem as the most significant takeaway from the incident. He lauded the agency for its forthrightness in acknowledging both its successes and its failures. "To my knowledge," Valadon wrote, "it is also the first time a national cybersecurity agency has publicly advocated for secrets scanning and for simplifying relations with security researchers. That is exactly the incident communication we should expect from every organization." This level of transparency and proactive advocacy for best practices sets a commendable precedent for other organizations, particularly those tasked with national security and critical infrastructure protection. The incident, while concerning, has served as a catalyst for CISA to implement robust improvements, offering a valuable case study in incident response and the ongoing evolution of cybersecurity best practices.