A recent data leak at the US Cybersecurity and Infrastructure Security Agency (CISA) has provided a stark reminder of the importance of proper security incident response and continuous monitoring. For almost six months, a contractor had publicly exposed dozens of internal CISA credentials on GitHub, including AWS Govcloud keys, before being notified by KrebsOnSecurity. The leak highlights significant gaps in CISA’s initial response, which experts say provide valuable lessons for all security teams.
The exposure was discovered by the security firm GitGuardian, which had been scanning public code repositories at GitHub and elsewhere for exposed secrets. On May 15, 2026, the company asked KrebsOnSecurity to help notify CISA about the existence of a public GitHub repository called “Private CISA” that included 844 MB of sensitive data. The repository contained administrative credentials to three Amazon AWS GovCloud servers, as well as plaintext usernames and passwords for dozens of internal CISA systems.
CISA’s initial response was slow, taking more than 48 hours to invalidate the AWS keys and other exposed secrets. In its postmortem report on the incident, the agency acknowledged that the complexities of its systems and interconnections with federal and industry partners caused delays in key rotation. However, CISA also admitted that it can do better when it comes to responding to security incident notifications from external parties.
The report emphasizes the importance of clear and distinct reporting channels, which were not well defined at CISA. This led the security researcher to try multiple avenues to notify the agency, including emailing the contractor and submitting through CISA’s vulnerability disclosure platform. CISA has since refined its reporting channels to make them easier and faster for researchers.
The incident also highlights the importance of continuous monitoring of public code repositories like GitHub for exposed secrets. Guillaume Valadon, the GitGuardian researcher who first contacted KrebsOnSecurity about the exposure, noted that CISA ignored nine automated alerts about the exposed credentials prior to notification on May 15. Valadon emphasized that making it trivial to report a leak about an organization’s own infrastructure is crucial, and that publishing reporting instructions in multiple prominent locations can help prevent such incidents.
CISA has since rotated all secrets and created an action plan to improve management of developer secrets and better monitor for exposed secrets going forward. The agency also acknowledges that its playbook for responding to cybersecurity incidents did not include guidance on how to handle GitHub or other cloud services, highlighting the need for continuous scanning and monitoring.
The takeaway from this incident is clear: security teams must prioritize continuous monitoring and proper incident response procedures to prevent similar breaches. As Valadon notes, “Continuous monitoring of public GitHub surfaced [the exposed repository]…Comprehensive internal scanning could have caught the plaintext passwords and committed backups long before they left the building.” By learning from CISA’s mistakes, security professionals can take steps to improve their own organizations’ preparedness for such incidents.
Source: Krebs on Security — 2026-07-13