The Cybersecurity and Infrastructure Security Agency (CISA) GitHub credential leak that spilled AWS GovCloud keys, plaintext passwords, and internal government files into a public repository went undetected from November 2025 until a private security researcher spotted it in May 2026. That, in itself, is the story. The slightly more uncomfortable coda is that when CISA finally had to respond, it did not have an incident response playbook for this class of incident. It had to write one on the fly.
What the CISA GitHub Credential Leak Actually Exposed
The repository at the centre of it all was named, with unfortunate irony, ‘Private-CISA.’ A contractor working with the agency had uploaded it to their personal GitHub account rather than CISA’s official organisation, and had disabled the default GitHub setting that blocks publication of SSH keys and other secrets in public code repositories.
According to Krebs on Security, the repository contained cloud keys, tokens, and plaintext usernames and passwords for dozens of internal CISA systems. Also in the mix: administrator credentials for three AWS GovCloud servers and internal CISA and Department of Homeland Security files. Researcher Valadon, described in Krebs’s reporting, suspected the contractor had been using the repository to synchronise files between a work laptop and a home computer, with commit logs showing regular activity since November 2025.
That means the repository sat publicly accessible for roughly six months before anyone flagged it. And the person who flagged it was not anyone inside the agency.
A security researcher at firm GitGuardian spotted the exposed credentials and tried to alert the contractor directly. No response. The researcher then went to journalist Brian Krebs, who contacted CISA. Only after that did the agency pull the repository offline, then revoke and replace all exposed credentials.
CISA has confirmed no customer or mission data was exposed in the incident, and its forensic review found no use of the leaked credentials outside agency systems. Small mercies. The agency also thanked the researcher and reporter, which is either genuine gratitude or the world’s most gracious acknowledgement that outside journalists are currently doing part of your monitoring job for you.
No Playbook, No Director, No Third of Its Staff
CISA published an after-action blog post that reads, in places, like a confession. The postmortem acknowledged inadequate controls on public repository uploads, weaknesses in how secrets were handled even in private repositories, and the absence of a clear reporting channel for external researchers to alert the agency. That last point CISA has since said it is working to address, describing its researcher notification channels as ‘not well defined.’
The absence of a GitHub and cloud-specific incident response playbook, however, is the line that sits uncomfortably. For the agency whose entire mission is helping other organisations prepare for and respond to cyber incidents, having to build that playbook during the incident itself is a structural problem, not just an oversight.
The context around CISA makes that structural problem harder to wave away. The agency has been without a permanent director since President Donald Trump’s second term began in January 2025. Cuts, furloughs, and layoffs have reduced its workforce by roughly a third since then. An agency operating at two-thirds of its staff, with no permanent leadership, and with monitoring gaps wide enough to miss a six-month-old public credential exposure is an agency under meaningful strain.
CISA’s postmortem is, at least, candid. Acknowledging that secrets had also reached private repositories, not just the public one, and that the incident reporting mechanism for external researchers was unclear before this happened, are not the kind of admissions agencies typically rush to publish. That transparency deserves credit, even if the facts underlying it do not.
The broader lesson security practitioners are drawing from the episode is a familiar one: secrets management in cloud and code environments requires active monitoring, not just policy. Disabling GitHub’s default secret-scanning protections, as the contractor here appears to have done, turns a guardrail into a gap. The fact that it took an external researcher and a journalist to close that gap, rather than the agency’s own tooling, is the part worth watching as CISA rebuilds its playbooks and, eventually, its headcount.
Whether the next exposure waits for a reporter to notice it, or gets caught internally, may depend on which of those two things happens first.
