The Cybersecurity and Infrastructure Security Agency (CISA) has released a formal postmortem detailing how a contractor’s accidental exposure of internal credentials on GitHub persisted for almost six months. The incident, which involved 844 MB of data including AWS GovCloud keys and plaintext passwords, highlights critical gaps in how federal agencies manage developer secrets and respond to external security reports. CISA officials acknowledged that the agency’s internal reporting channels were insufficiently defined, causing delays in remediation.
Anatomy of the Credential Exposure
On May 15, 2026, the security firm GitGuardian alerted CISA to a public repository titled “Private CISA.” The repository contained sensitive files, most notably a document named “importantAWStokens,” which provided administrative access to three Amazon AWS GovCloud servers. Additionally, a file labeled “AWS-Workspace-Firefox-Passwords.csv” exposed plaintext usernames and passwords for multiple internal CISA systems.
According to the postmortem report authored by Preston Werntz, acting chief information officer, and Brad Libbey, acting chief information security officer, the exposure lasted almost six months. While CISA’s incident response team ultimately rotated the compromised secrets and revoked the contractor’s access, the agency required more than 48 hours to fully invalidate the AWS tokens once alerted. CISA attributed this delay to the complexity of its system interconnections with federal and industry partners.
Failures in Incident Reporting Channels
A central finding of the report is the failure of CISA’s external reporting infrastructure. Guillaume Valadon, the researcher at GitGuardian who identified the leak, noted that nine automated alerts sent to the accounts associated with the repository went unanswered.
When GitGuardian attempted to escalate the issue, it faced procedural hurdles. The researcher attempted to contact the contractor, submitted a report through CISA’s general vulnerability disclosure platform—which is designed for vulnerabilities impacting the broader cybersecurity community rather than internal infrastructure—and eventually involved a reporter to ensure the alert reached the correct internal stakeholders.
“In CISA’s case, these channels were not well defined, leading the security researcher to try multiple avenues,” Werntz and Libbey wrote in the agency’s analysis. CISA is now working to refine these channels, advising other organizations to publish reporting instructions in multiple prominent locations rather than relying solely on a single security.txt file.
Strategic Shifts in Secret Management
The incident has prompted CISA to overhaul its internal developer security protocols. The agency reported that its existing incident response playbook lacked specific procedures for handling leaks on cloud platforms like GitHub. Moving forward, CISA plans to implement:
- Continuous Scanning: Expanding beyond quarterly audits to active, continuous monitoring of public repositories for exposed secrets.
- Refined Reporting: Creating distinct communication channels for internal infrastructure incidents to prevent them from being routed to product-focused bug queues.
- Enhanced Key Management: Strengthening the lifecycle management of developer secrets to ensure faster rotation and invalidation.
Despite the exposure, CISA maintained that its zero-trust implementation and enhanced logging allowed the agency to confirm that no mission or customer data was accessed by unauthorized parties. The leaked credentials were not used outside of CISA’s internal environments.
Industry Lessons on Transparency
The CISA postmortem is being viewed as a significant exercise in institutional transparency. Valadon, who identified the leak, praised the agency for documenting its shortcomings, noting that it is the first time a national cybersecurity agency has publicly advocated for secrets scanning and the simplification of relations with external security researchers. The agency’s report serves as a benchmark for how organizations should communicate during security failures: acknowledging the breakdown in processes while providing a clear roadmap for future remediation.
Worth a look